Executive brief
The Linux kernel's IPsec transform (xfrm) state cache has a race condition that allows an invalid security state to be added to the input path cache after it has been marked for destruction. An attacker with network access could exploit this to cause denial of service or potentially corrupt IPsec packet handling, affecting systems that rely on IPsec for secure communications.
Technical details
A use-after-check race condition exists in the xfrm_input_state_lookup() function in net/xfrm/xfrm_state.c. The function checks whether an xfrm state is valid (XFRM_STATE_VALID) before acquiring the xfrm_state_lock, then attempts to cache the state. Between the validity check and lock acquisition, another thread can kill the state, resulting in a dead state being added to the cache. The fix moves the validity check inside the critical section protected by xfrm_state_lock. The vulnerability can be triggered via network packets on the input path. No user interaction or authentication is required. A patch is available in the upstream Linux kernel.
Affected products
- Linux Linux kernel Affected versions prior to upstream commit ddd3d0132920319ac426e12456013eadbae67e15
Timeline
- 2026-08-15: disclosed
- 2026-06-12: patched: Upstream fix by Herbert Xu