Executive brief
A race condition vulnerability was identified in the Linux kernel's networking component responsible for handling IPsec over TCP. This flaw could allow a local attacker to cause a system crash or potentially execute unauthorized actions by triggering a use-after-free condition during the closing of a network socket. The issue affects the stability and security of systems utilizing specific VPN or encrypted tunneling configurations.
Technical details
A race condition exists in net/xfrm/espintcp.c within the espintcp_close() function. The vulnerability stems from the use of cancel_work_sync(), which does not prevent espintcp_tx_work() from being rescheduled by other paths like the Delayed ACK handler or ksoftirqd after the cancellation attempt. If the worker is rescheduled and runs after the context (ctx) or socket (sk) has been freed, it results in a use-after-free (UAF) dereference. The fix replaces cancel_work_sync() with disable_work_sync() to ensure the work cannot be queued again during the teardown process. This is a local vulnerability requiring low privileges.
Affected products
- Linux Linux Kernel 5.6 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6, 7.0-rc1
Timeline
- 2026-02-18: other: Patch authored
- 2026-03-10: disclosed: CVE published
- 2026-05-20: advisory: NVD last modified with enrichment data