Executive brief
The Linux kernel's espintcp (ESP over TCP) implementation is a network encapsulation mechanism that tunnels encrypted traffic over TCP connections. A race condition in socket close operations allows concurrent access to freed memory, potentially leading to kernel crashes or memory corruption when an application closes an espintcp socket while data is being transmitted.
Technical details
This vulnerability is a use-after-free (UAF) race condition in the espintcp_close() function within net/xfrm/espintcp.c. The root cause is that espintcp_close() deallocates a socket buffer (emsg->skb) via kfree_skb() without holding the socket lock, while concurrently the xfrm_trans_reinject work queue executes esp_output_tcp_finish(), which attempts to read and process the same buffer. An attacker with local access can trigger this race by creating an espintcp socket and closing it while transmission is occurring. The fix adds a synchronize_rcu() call after resetting sk_prot to &tcp_prot, ensuring all RCU-protected readers (including esp_output_tcp_finish()) complete before memory is freed. Patches are available in Linux stable kernel versions.
Affected products
- Linux Linux kernel All versions with espintcp support (since kernel 5.0)
Timeline
- 2026-09-04: disclosed: CVE-2026-80848 published