CVE-2026-98366

A vulnerability in the Linux kernel's xfrm IP-TFS module allows an out-of-bounds stack read in iptfs_skb_reset_frag_walk() due to missing fragment index validation. A crafted AGGFRAG packet can trigger this, causing a system crash or potential information leak.

In the Linux kernel, a flaw in xfrm/iptfs handling of inner packet fragmentation occurs when the start of an inner packet is split across two outer packets such that fewer than 4 bytes land at the end of the first one. This bypasses IP header length validation, leading to a buffer overflow and kernel panic (DoS).

In the Linux kernel, a use-after-free vulnerability was fixed in xfrm_state_netlink() when handling ALLOCSPI requests. xfrm_alloc_userspi() calls alloc_compat() again, but passes the original request skb and its header, which for compat requests causes the 228-byte compat xfrm_userspi_info to be interpreted as the 232-byte native layout and reads four bytes past the declared payload. A multicast clone of the request shares skb_shared_info and can observe that child, and xfrm_user_rcv_msg() frees it after the request handler returns, leading to a race and use-after-free.

A bug was fixed in the Linux kernel xfrm subsystem where xfrm_trans_reinject(), after being converted from a tasklet to a workqueue, ran in process context without an RCU read lock. This caused suspicious RCU usage warnings and potential validity issues for dst and netdevice references of packets queued through the workqueue.

A vulnerability in the Linux kernel's ESP (IPsec) implementation was found on the out-of-place output path, where the skb frag array was mutated without downgrading managed zerocopy frags (SKBFL_MANAGED_FRAG_REFS). This breaks the managed-frag invariant, potentially leading to use-after-free of zerocopy pages and memory leaks.

In the Linux kernel, a vulnerability was fixed in the RDMA/siw driver in siw_accept(). If siw_qp_modify() fails, the QP's state_lock is released before error path cleanup, allowing a concurrent ibv_modify_qp() to transition the QP to ERROR and free the cep structure, leading to use-after-free. The fix clears qp->cep and drops the association reference under the held write lock.

In the Linux kernel RDMA/rxe subsystem, mr_check_range() has an integer overflow vulnerability that allows a remote unauthenticated client to bypass memory range validation and trigger out-of-bounds access, causing a kernel oops. The fix rewrites the check in an overflow-safe form, returning -EINVAL for crafted requests.

In the Linux kernel xfrm subsystem, during bundle creation, a missing reference to net_device leads to a use-after-free when a concurrent interface deletion occurs. The fix reads dst->dev via dst_dev_rcu() and keeps the RCU read-side critical section active until xfrm_fill_dst() takes the required references.

In the Linux kernel firmware arm_scpi subsystem, scpi_dvfs_get_info() does not check the upper bound of the OPP count read from SCP firmware, which can lead to out-of-bounds read and incorrect sizing of the allocated OPP table. The fix rejects both zero and too-large OPP counts, returning -EINVAL.

In the Linux kernel clk scpi subsystem, scpi_dvfs_recalc_rate() does not check the upper bound of the DVFS index returned by dvfs_get_idx(), which can lead to out-of-bounds read and treating garbage as clock frequency. The fix treats indexes greater than or equal to the OPP count as invalid and returns 0.