Race Condition in Linux Kernel's espintcp Sockets

CVE-2026-80848

What is CVE-2026-80848?

A race condition vulnerability exists in the Linux kernel's handling of espintcp sockets. The issue arises when espintcp_close() frees memory without ensuring socket locks, leading to potential concurrent access by the xfrm_trans_reinject work queue. This could result in unintended data leakage or corrupted memory states. The fix involves implementing a synchronize_rcu() call after resetting socket protocol to ensure proper synchronization and prevent memory issues introduced by concurrent operations.

References