In the Linux kernel, the following vulnerability has been resolved:

xfrm: espintcp: fix UAF during close

ZDI reported and analyzed a race condition during close for espintcp sockets:

espintcp close() frees emsg->skb via kfree skb() without holding any socket lock. Concurrently, the xfrm trans reinject work queue invokes esp output tcp finish() -> espintcp push skb() -> espintcp push msgs() -> skb send sock locked(), which reads the same skb as a data source.

Fix this by adding a synchronize rcu() call after resetting sk prot, since esp output tcp finish() runs under RCU and won't use a socket with sk prot == &tcp prot. Simply taking the socket lock in espintcp close() could lead to leaks, if esp output tcp finish() re-adds an skb in the slot we just freed. After this, the existing barrier() is no longer needed.