CVE-2026-80848

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description A race condition exists in the xfrm espintcp sockets during the close process. The espintcp close() function frees emsg->skb using kfree skb() without holding a socket lock. Simultaneously, the xfrm trans reinject work queue may trigger a sequence of calls: esp output tcp finish() -> espintcp push skb() -> espintcp push msgs() -> skb send sock locked(), which attempts to read the same skb as a data source. This leads to a Use-After-Free (UAF) condition, where the system attempts to access memory that has already been freed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.