PT-2026-52335 · Linux · Linux

Published

2026-06-25

·

Updated

2026-06-25

·

CVE-2026-53240

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
xfrm: iptfs: fix use-after-free on first skb in input process payload
input process payload() stores first skb into xtfs->ra newskb under drop lock when starting partial reassembly, then unlocks and breaks out of the processing loop. The post-loop check reads xtfs->ra newskb without the lock to decide whether first skb is still owned:
if (first skb && first iplen && !defer && first skb != xtfs->ra newskb)
Between spin unlock and this read, a concurrent CPU running iptfs reassem cont() (or the drop timer hrtimer) can complete reassembly, NULL xtfs->ra newskb, and free the skb. The check then evaluates first skb != NULL as true, and pskb trim/ip summed/consume skb operate on the freed skb — a use-after-free in skbuff head cache.
Replace the unlocked read with a local bool that records whether first skb was handed to the reassembly state in the current call. The flag is set after the existing spin unlock, before the break, using the pointer equality that is stable at that point (first skb == skb iff first skb was stored in ra newskb).
Found an issue in the description? Have something to add? Feel free to write us 👾

Related Identifiers

CVE-2026-53240

Affected Products

Linux