Linux Kernel CVE-2026-98230

Requires the Linux XFRM/IPsec state framework to be in active use and the attacker to be able to add and delete xfrm states - an operation normally gated by CAP_NET_ADMIN, which unprivileged users can obtain within a user+network namespace (relevant to container escapes). The specific trigger is a double __xfrm_state_delete() on the same state, so the attacker must induce or win a race where the same state_cache/state_cache_input node is unlinked twice; this is a timing-dependent condition (reflected as AC:H), not reachable by a single deterministic call. Limiting factors: exploitation is local only (no network vector despite the networking subsystem), requires existing privileges to manipulate xfrm state, requires winning the delete/delete race and grooming the slab after reuse, and is moot on kernels already patched to the fixed stable versions.

Signals point consistently to a real-but-not-urgent kernel memory-corruption bug rather than a mass-exploitation priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) describes a local, high-complexity, low-privilege race condition - a second concurrent __xfrm_state_delete() on the same xfrm_state causes a write use-after-free through LIST_POISON2, which in turn spawns a read use-after-free during an RCU hlist traversal. The 7.0 (High) score is driven entirely by the C:H/I:H/A:H kernel-memory impact, not by ease of reach: AC:H reflects that the attacker must win a delete/delete race, and AV:L means no remote reach despite xfrm being a networking (IPsec) subsystem. This aligns with the low EPSS of 0.21% (10th percentile), the absence of CISA KEV listing, and no public PoC - so there is no evidence of active or impending widespread exploitation. The 'Information Disclosure' tag understates the issue: the root cause is a write use-after-free (memory corruption / potential privilege escalation) that only secondarily yields a read UAF; treat this as a corruption primitive, not merely info leak. Net: patch on a normal kernel-maintenance cadence; this is not a drop-everything issue absent a target-specific threat model involving untrusted local users or containers with CAP_NET_ADMIN in a network namespace.

A local attacker with the ability to create and tear down IPsec/XFRM states (e.g. a user holding CAP_NET_ADMIN, including inside an unprivileged user+network namespace) races two __xfrm_state_delete() calls against the same state so the state_cache/state_cache_input node is deleted twice, driving a write through LIST_POISON2 after the slab is reused. By grooming the kernel slab to control the reused object, this write use-after-free can be steered toward memory corruption and potential local privilege escalation, with a follow-on read UAF in xfrm_input_state_lookup(). No public exploit or PoC is identified at time of analysis, and the high attack complexity (winning the race) makes reliable exploitation non-trivial.