CVE-2026-98364

A use-after-free vulnerability exists in the Linux kernel within the xfrm subsystem during bundle creation. The functions xfrm_bundle_create() and xfrm_create_dummy_bundle() improperly read dst->dev into a local pointer without acquiring a device reference before passing it to xfrm_fill_dst()....

EUVD-2026-93349

In the Linux kernel, the following vulnerability has been resolved: xfrm: hold netdevice reference under RCU in bundle creation xfrmbundlecreate and xfrmcreatedummybundle read dst-dev into a local pointer without taking a device reference, then pass it to xfrmfilldst. A concurrent RTMDELLINK...