CVE-2026-80846

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the XFRM implementation where ESP-in-TCP records are processed via the TCP strparser. The handle esp() function restores skb->dev from the saved skb iif before the packet enters the XFRM input path. If queued TCP data is processed after the original ingress device has been removed (such as during net namespace or veth teardown), the dev get by index rcu() function returns NULL. Because the XFRM IPv4 and IPv6 input paths require skb->dev to be valid for route lookup, this can lead to a NULL device dereference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.