{"id":"CVE-2026-80848","summary":"xfrm: espintcp: fix UAF during close","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: espintcp: fix UAF during close\n\nZDI reported and analyzed a race condition during close for espintcp\nsockets:\n\n    espintcp_close() frees emsg-\u003eskb via kfree_skb() without holding\n    any socket lock. Concurrently, the xfrm_trans_reinject work queue\n    invokes esp_output_tcp_finish() -\u003e espintcp_push_skb() -\u003e\n    espintcp_push_msgs() -\u003e skb_send_sock_locked(), which reads the\n    same skb as a data source.\n\nFix this by adding a synchronize_rcu() call after resetting sk_prot,\nsince esp_output_tcp_finish() runs under RCU and won't use a socket\nwith sk_prot == &tcp_prot.  Simply taking the socket lock in\nespintcp_close() could lead to leaks, if esp_output_tcp_finish()\nre-adds an skb in the slot we just freed. After this, the existing\nbarrier() is no longer needed.","modified":"2026-09-06T03:46:54.008373486Z","published":"2026-09-04T15:54:58.427Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80848.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/24efebecf415ba264adba0f0491cec436463a14f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/29121c5e6591da527e8e36ddac7120dc527f574d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4b31a875693c480c611519faca46216514e3e052"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4bc0dfa28dca6fc0084203732695968049c44072"},{"type":"WEB","url":"https://git.kernel.org/stable/c/54b41ad14da9a981131ab6e4d3f79321a503ea5d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/deb232e884877bf10b4ce2580909eedec986c284"},{"type":"WEB","url":"https://git.kernel.org/stable/c/eb3bbf29c723fe75c0eb92be14f0ec92971fe272"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ed5d9102190c45fc70121c036b0626b740040b75"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ff8dd7a932f34409a56e1b91a1219340f17457e9"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80848.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80848"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593"},{"fixed":"29121c5e6591da527e8e36ddac7120dc527f574d"},{"fixed":"ed5d9102190c45fc70121c036b0626b740040b75"},{"fixed":"4bc0dfa28dca6fc0084203732695968049c44072"},{"fixed":"ff8dd7a932f34409a56e1b91a1219340f17457e9"},{"fixed":"4b31a875693c480c611519faca46216514e3e052"},{"fixed":"24efebecf415ba264adba0f0491cec436463a14f"},{"fixed":"eb3bbf29c723fe75c0eb92be14f0ec92971fe272"},{"fixed":"54b41ad14da9a981131ab6e4d3f79321a503ea5d"},{"fixed":"deb232e884877bf10b4ce2580909eedec986c284"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80848.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.0"},{"fixed":"5.10.269"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.220"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.187"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.156"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.108"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.49"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.13"}]},{"type":"ECOSYSTEM","events":[{"introduced":"7.2.0"},{"fixed":"7.2.3"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80848.json"}}],"schema_version":"1.9.0"}