CVE-2026-53240 is a vulnerability in Linux Kernel
Published on June 25, 2026
xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload
In the Linux kernel, the following vulnerability has been resolved:
xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload
__input_process_payload() stores first_skb into xtfs->ra_newskb under
drop_lock when starting partial reassembly, then unlocks and breaks out
of the processing loop. The post-loop check reads xtfs->ra_newskb
without the lock to decide whether first_skb is still owned:
if (first_skb && first_iplen && !defer && first_skb != xtfs->ra_newskb)
Between spin_unlock and this read, a concurrent CPU running
iptfs_reassem_cont() (or the drop_timer hrtimer) can complete
reassembly, NULL xtfs->ra_newskb, and free the skb. The check then
evaluates first_skb != NULL as true, and pskb_trim/ip_summed/consume_skb
operate on the freed skb a use-after-free in skbuff_head_cache.
Replace the unlocked read with a local bool that records whether
first_skb was handed to the reassembly state in the current call. The
flag is set after the existing spin_unlock, before the break, using the
pointer equality that is stable at that point (first_skb == skb iff
first_skb was stored in ra_newskb).
Products Associated with CVE-2026-53240
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 3f3339885fb343b7b42d7c34717108ce07da24ae and below 8d9a79fbf5172d9c4c0146057af2360913265a11 is affected.
- Version 3f3339885fb343b7b42d7c34717108ce07da24ae and below ff2ee35b6ce5fa8a8e24ea50b15733d5c8780198 is affected.
- Version 3f3339885fb343b7b42d7c34717108ce07da24ae and below eb48730bb827d1550401a5d391903f9d90b493c8 is affected.
- Version 6.14 is affected.
- Before 6.14 is unaffected.
- Version 6.18.36, <= 6.18.* is unaffected.
- Version 7.0.13, <= 7.0.* is unaffected.
- Version 7.1, <= * is unaffected.