{"id":33433,"date":"2026-10-06T20:31:59","date_gmt":"2026-10-06T12:31:59","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98364"},"modified":"2026-10-06T20:31:59","modified_gmt":"2026-10-06T12:31:59","slug":"cve-2026-98364","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98364","title":{"rendered":"CVE-2026-98364 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: hold net_device"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>xfrm: hold net_device reference under RCU in bundle creation<\/p>\n<p>xfrm_bundle_create() and xfrm_create_dummy_bundle() read dst-&gt;dev into<br \/>\na local pointer without taking a device reference, then pass it to<br \/>\nxfrm_fill_dst(). A concurrent RTM_DELLINK replaces dst-&gt;dev via<br \/>\ndst_dev_put() and frees the old net_device, causing a use-after-free<br \/>\nwhen xfrm6_fill_dst() later dereferences the stale dev pointer.<\/p>\n<p>  BUG: KASAN: slab-use-after-free in xfrm6_fill_dst+0x82c\/0x860<br \/>\n  (net\/ipv6\/xfrm6_policy.c:86 netdev_hold())<br \/>\n  Read of size 8 at addr ffff8880142fe588 by task exploit\/153<br \/>\n  Call Trace:<br \/>\n   xfrm6_fill_dst+0x82c\/0x860<br \/>\n   xfrm_resolve_and_create_bundle+0x21d4\/0x2bd0<br \/>\n   xfrm_lookup_with_ifid+0x485\/0x1640<br \/>\n   ip6_dst_lookup_flow+0x19b\/0x1e0<br \/>\n   udpv6_sendmsg+0x1443\/0x2dd0<\/p>\n<p>Fix this by reading dst-&gt;dev via dst_dev_rcu() and keeping the RCU<br \/>\nread-side critical section active until xfrm_fill_dst() has taken the<br \/>\nrequired device references.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>xfrm: hold net_device reference under RCU in bundle creation<\/p>\n<p>xfrm_bundle_create() and xfrm_create_dummy_bundle() read dst-&gt;dev int<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33433","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33433","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33433"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33433"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33433"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}