---
id: CVE-2026-98364
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xfrm: hold net_device reference under RCU in bundle creation

  xfrm_bundle_create() and xfrm_create_dummy_bundle() read dst->dev into
  a local pointer without taking a de…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xfrm: hold net_device reference under RCU in bundle creation

  xfrm_bundle_create() and xfrm_create_dummy_bundle() read dst->dev into
  a local pointer without taking a de…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 25ee3286dcbc830a833354bb1d15567956844813 <
    8d85d6bc9c46dc41cb2be0eac53f8ab068c3a807
  - >-
    Linux >= 25ee3286dcbc830a833354bb1d15567956844813 <
    9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1
  - Linux 2.6.25
published: '2026-10-06'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T09:18:30.547'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98364'
references:
  - url: 'https://git.kernel.org/stable/c/8d85d6bc9c46dc41cb2be0eac53f8ab068c3a807'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-06T08:50:17.390Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xfrm: hold net_device reference under RCU in bundle creation

xfrm_bundle_create() and xfrm_create_dummy_bundle() read dst->dev into
a local pointer without taking a device reference, then pass it to
xfrm_fill_dst(). A concurrent RTM_DELLINK replaces dst->dev via
dst_dev_put() and frees the old net_device, causing a use-after-free
when xfrm6_fill_dst() later dereferences the stale dev pointer.

  BUG: KASAN: slab-use-after-free in xfrm6_fill_dst+0x82c/0x860
  (net/ipv6/xfrm6_policy.c:86 netdev_hold())
  Read of size 8 at addr ffff8880142fe588 by task exploit/153
  Call Trace:
   xfrm6_fill_dst+0x82c/0x860
   xfrm_resolve_and_create_bundle+0x21d4/0x2bd0
   xfrm_lookup_with_ifid+0x485/0x1640
   ip6_dst_lookup_flow+0x19b/0x1e0
   udpv6_sendmsg+0x1443/0x2dd0

Fix this by reading dst->dev via dst_dev_rcu() and keeping the RCU
read-side critical section active until xfrm_fill_dst() has taken the
required device references.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.