CVE-2026-98231

A use-after-free vulnerability exists in the Linux kernel within the xfrm subsystem. The issue arises because xfrm_dev_state_flush() drops the xfrm_state_dev_gc_lock before calling xfrm_dev_state_free() to avoid sleeping in driver callbacks. Because the device GC list does not hold an xfrm_state ...

EUVD-2026-93159

In the Linux kernel, the following vulnerability has been resolved: xfrm: serialize state GC with device state flush The deferred-device pass in xfrmdevstateflush finds states under xfrmstatedevgclock, but drops the lock before calling xfrmdevstatefree because the driver callback may sleep. The...