Microsoft AI scan finds 59 Linux kernel bugs, eight with root exploits
Thirty-three CVEs are assigned so far, 24 rated High or above, and 38 fixes are already merged upstream.
68
CVE-2026-98364
Use-after-free in Linux kernel XFRM bundle creation
- CVSS 3.1
- 7.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-98364 is a use-after-free in the Linux kernel XFRM (IPsec) bundle path. xfrm_bundle_create() and xfrm_create_dummy_bundle() copy dst->dev without holding a device reference and later pass it to xfrm_fill_dst(); a concurrent RTM_DELLINK can replace and free that net_device via dst_dev_put(), so xfrm6_fill_dst() dereferences a stale pointer. A local attacker with low privileges can race this path and corrupt kernel memory, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 7.8, AV:L/AC:L/PR:L). Linux systems whose kernels include the unfixed IPv6 XFRM bundle code are affected; the advisory does not name version ranges. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Install a Linux kernel update from your distribution or vendor that includes the xfrm fix (read dst->dev via dst_dev_rcu() and hold the RCU section until xfrm_fill_dst() takes a device reference). No fixed version is named in the advisory, so match the changelog or stable-branch note for CVE-2026-98364 rather than guessing a release. Until then, restrict local accounts that can drive IPsec/XFRM lookups or delete network interfaces, and watch for kernel crashes or KASAN reports in xfrm6_fill_dst.
| Product | Affected |
|---|---|
| Linux kernel | — |
Estimated exposure
massHundreds of millions of Linux systems may contain the affected xfrm code (unpatched subset unknown) — The flaw is in the mainline Linux IPsec/XFRM networking path, which ships on a very large share of servers, cloud images, and other Linux systems; no version bounds, install counts, or scan data are in the advisory, so this is only an…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In the Linux kernel, the following vulnerability has been resolved: xfrm: hold net_device reference under RCU in bundle creation xfrm_bundle_create() and xfrm_create_dummy_bundle() read dst->dev into a local pointer without taking a device reference, then pass it to xfrm_fill_dst(). A concurrent RTM_DELLINK replaces dst->dev via dst_dev_put() and frees the old net_device, causing a use-after-free when xfrm6_fill_dst() later dereferences the stale dev pointer. BUG: KASAN: slab-use-after-free in xfrm6_fill_dst+0x82c/0x860 (net/ipv6/xfrm6_policy.c:86 netdev_hold()) Read of size 8 at addr ffff8880142fe588 by task exploit/153 Call Trace: xfrm6_fill_dst+0x82c/0x860 xfrm_resolve_and_create_bundle+0x21d4/0x2bd0 xfrm_lookup_with_ifid+0x485/0x1640 ip6_dst_lookup_flow+0x19b/0x1e0 udpv6_sendmsg+0x1443/0x2dd0 Fix this by reading dst->dev via dst_dev_rcu() and keeping the RCU read-side critical section active until xfrm_fill_dst() has taken the required device references.
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H