CVE-2026-53240

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the skbuff head cache within the xfrm iptfs component. The function input process payload() stores first skb into xtfs->ra newskb under a drop lock during partial reassembly, then releases the lock and exits the processing loop. A subsequent check reads xtfs->ra newskb without the lock to determine if first skb is still owned. If a concurrent CPU executing iptfs reassem cont() or a drop timer hrtimer completes the reassembly and frees the skb between the lock release and the read, the check may incorrectly evaluate as true. This leads to pskb trim(), ip summed(), and consume skb() operating on the freed memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.