Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem, specifically within the IP-TFS (IP Traffic Flow Security) component. This flaw could allow a remote attacker to cause a system crash or potentially execute unauthorized code by exploiting a race condition during network packet reassembly. This impact could lead to service outages or a compromise of the affected server's integrity.
Technical details
A use-after-free vulnerability exists in net/xfrm/xfrm_iptfs.c within the __input_process_payload function. The root cause is a race condition where a socket buffer (skb) is accessed after being freed by a concurrent CPU or timer. Specifically, the code performs an unlocked read of xtfs->ra_newskb to determine ownership of first_skb; if a concurrent process completes reassembly and frees the skb between the spin_unlock and this read, the kernel may attempt to operate on freed memory (pskb_trim, ip_summed, or consume_skb). This can be triggered by network traffic utilizing IPTFS. Patches have been released for various stable branches including 6.18.x and 7.0.x.
Affected products
- Linux Linux 6.14 to 7.1
Timeline
- 2026-05-26: other: Vulnerability fix authored
- 2026-06-25: disclosed: CVE published