CVE-2026-53240: Linux Kernel IPTFs Use-After-Free Race Condition

Technical summary

CVE-2026-53240 is a race condition use-after-free in the `__input_process_payload()` function within the Linux kernel's xfrm IPTFs implementation. The vulnerability arises from an unsynchronized check of the `xtfs->ra_newskb` pointer outside the `drop_lock` spinlock. When a partial IPTFs reassembly is initiated, `first_skb` is stored into `xtfs->ra_newskb` while holding the lock. After releasing the lock and breaking from the processing loop, the code performs a check: `if (first_skb && first_iplen && !defer && first_skb != xtfs->ra_newskb)`. During the window between the spin_unlock and this read, a concurrent call to `iptfs_reassem_cont()` or the reassembly timer (hrtimer) may complete reassembly, NULL `xtfs->ra_newskb`, and free the associated skbuff. The unlocked read of `xtfs->ra_newskb` then evaluates to a stale comparison, causing subsequent `pskb_trim()`, `ip_summed` modification, and `consume_skb()` calls to operate on freed memory from the skbuff_head_cache. The fix replaces the unlocked pointer read with a locally scoped boolean flag set immediately after the spin_unlock, capturing the stable ownership state before the race window opens.

Business impact

Exploitation could allow a local authenticated user to trigger a kernel panic (denial of service) or potentially achieve privilege escalation on systems running the vulnerable Linux kernel with IPTFs enabled. IPTFs is used to secure tunnel traffic in IPsec deployments; systems relying on IPsec for VPN, site-to-site encryption, or other tunnel security may be exposed. Organizations operating high-availability infrastructure face service disruption risk from DoS; those in regulated environments must assess compliance impact if IPsec-protected traffic is critical.

Affected systems

The Linux kernel versions listed in the provided data are affected. IPTFs is a relatively specialized feature within the IPsec stack, so exposure is limited to systems that have explicitly enabled IPTFs in their kernel configuration and are processing fragmented IPsec-protected traffic. Both server and embedded Linux systems using IPsec tunnels are potential targets. Verify the exact affected kernel versions and backport status against the official Linux kernel security advisory.

Exploitability

This vulnerability requires local authenticated access (PR:L in the CVSS vector) to send specially crafted fragmented packets that trigger the race condition. The attack does not require user interaction (UI:N) and has a low attack complexity (AC:L). While not remotely exploitable in the traditional sense, any process capable of injecting or manipulating IPsec traffic on the system—or a local user with network access to trigger packet reassembly—could trigger it. The race condition itself has a narrow window, which may reduce practical exploitability in some scenarios, but the determinism depends on system load and CPU contention.

Remediation

Apply the kernel patch that adds the local boolean flag to track whether `first_skb` was handed to the reassembly state during the current function invocation. This flag should be set after the spin_unlock but before the break statement, using pointer equality (`first_skb == skb`) to determine if the skb was stored in `xtfs->ra_newskb`. The post-loop check must then reference this flag instead of re-reading `xtfs->ra_newskb` without synchronization. Verify the exact patch version against your kernel version's security advisory before deployment.

Patch guidance

Obtain the patched kernel version from your Linux distribution or the upstream Linux kernel repository. The patch has been available since the vulnerability resolution date. Coordinate patching with your change management process, especially for systems running in production IPsec tunnel environments. Test the patched kernel in a staging environment that replicates your fragmented traffic patterns before deploying to production. If immediate patching is not feasible, consider disabling IPTFs or restricting access to processes that can initiate IPsec traffic until the patch is applied.

Detection guidance

Monitor kernel logs for use-after-free related crashes in the xfrm or skbuff subsystems, particularly those referencing skbuff_head_cache. Enable kernel Address Sanitizer (KASAN) or similar dynamic analysis tools in test environments to catch UAF bugs earlier. Network-based detection is challenging, as the exploit is internal to the kernel; focus on host-based monitoring for unexpected kernel panics or processes triggering kernel BUGs during IPsec packet processing. Review IPTFs traffic statistics and reassembly state transitions in sysfs if available on your kernel version.

Why prioritize this

Although this vulnerability requires authenticated access and is not listed on the CISA KEV catalog, its HIGH CVSS score (8.8) reflects the severity of operating on freed memory. The impact encompasses all three security properties—confidentiality, integrity, and availability—making it a priority for systems that deploy IPTFs. Organizations running production IPsec tunnels should patch within their normal critical update cycle. Systems not using IPTFs can safely defer patching to their regular kernel maintenance schedule.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: (1) Network vector for packet-based triggering of kernel reassembly logic; (2) Low attack complexity, as no special exploitation technique is required beyond sending fragmented IPsec traffic; (3) Low privilege requirement, as any local authenticated process can initiate or influence IPsec traffic; (4) High impact to confidentiality, integrity, and availability due to the nature of use-after-free in kernel memory. The score does not include active exploitation or wide deployment in the wild, and is not mitigated by user interaction requirements. The lack of KEV status indicates no evidence of weaponized exploits as of the advisory date, but the underlying issue is fundamental to memory safety.

Frequently asked questions