{"id":"CVE-2026-80848","title":"xfrm: espintcp: fix UAF during close","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: espintcp: fix UAF during close\n\nZDI reported and analyzed a race condition during close for espintcp\nsockets:\n\n    espintcp_close() frees emsg->skb via kfree_skb(…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 29121c5e6591da527e8e36ddac7120dc527f574d","Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < ed5d9102190c45fc70121c036b0626b740040b75","Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 4bc0dfa28dca6fc0084203732695968049c44072","Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < ff8dd7a932f34409a56e1b91a1219340f17457e9","Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 4b31a875693c480c611519faca46216514e3e052","Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 24efebecf415ba264adba0f0491cec436463a14f","Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < eb3bbf29c723fe75c0eb92be14f0ec92971fe272","Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 54b41ad14da9a981131ab6e4d3f79321a503ea5d","Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < deb232e884877bf10b4ce2580909eedec986c284","Linux 5.6"],"published":"2026-09-04","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:44:42.445Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80848","references":[{"url":"https://git.kernel.org/stable/c/29121c5e6591da527e8e36ddac7120dc527f574d"},{"url":"https://git.kernel.org/stable/c/ed5d9102190c45fc70121c036b0626b740040b75"},{"url":"https://git.kernel.org/stable/c/4bc0dfa28dca6fc0084203732695968049c44072"},{"url":"https://git.kernel.org/stable/c/ff8dd7a932f34409a56e1b91a1219340f17457e9"},{"url":"https://git.kernel.org/stable/c/4b31a875693c480c611519faca46216514e3e052"},{"url":"https://git.kernel.org/stable/c/24efebecf415ba264adba0f0491cec436463a14f"},{"url":"https://git.kernel.org/stable/c/eb3bbf29c723fe75c0eb92be14f0ec92971fe272"},{"url":"https://git.kernel.org/stable/c/54b41ad14da9a981131ab6e4d3f79321a503ea5d"},{"url":"https://git.kernel.org/stable/c/deb232e884877bf10b4ce2580909eedec986c284"}],"tags":["cve.org"],"epss":0.00195,"epssPercentile":0.08587,"ingestedAt":"2026-10-19T09:16:01.496Z","slug":"CVE-2026-80848","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: espintcp: fix UAF during close\n\nZDI reported and analyzed a race condition during close for espintcp\nsockets:\n\n    espintcp_close() frees emsg->skb via kfree_skb() without holding\n    any socket lock. Concurrently, the xfrm_trans_reinject work queue\n    invokes esp_output_tcp_finish() -> espintcp_push_skb() ->\n    espintcp_push_msgs() -> skb_send_sock_locked(), which reads the\n    same skb as a data source.\n\nFix this by adding a synchronize_rcu() call after resetting sk_prot,\nsince esp_output_tcp_finish() runs under RCU and won't use a socket\nwith sk_prot == &tcp_prot.  Simply taking the socket lock in\nespintcp_close() could lead to leaks, if esp_output_tcp_finish()\nre-adds an skb in the slot we just freed. After this, the existing\nbarrier() is no longer needed.\n\n## Affected\n\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 29121c5e6591da527e8e36ddac7120dc527f574d`\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < ed5d9102190c45fc70121c036b0626b740040b75`\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 4bc0dfa28dca6fc0084203732695968049c44072`\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < ff8dd7a932f34409a56e1b91a1219340f17457e9`\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 4b31a875693c480c611519faca46216514e3e052`\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 24efebecf415ba264adba0f0491cec436463a14f`\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < eb3bbf29c723fe75c0eb92be14f0ec92971fe272`\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 54b41ad14da9a981131ab6e4d3f79321a503ea5d`\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < deb232e884877bf10b4ce2580909eedec986c284`\n- `Linux 5.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}