Is there a patch available for CVE-2026-98370?

Yes, a patch is available for CVE-2026-98370. Update the affected software to the latest version immediately.

Linux CVE-2026-98370

EUVD-2026-93355

2026-10-06 Linux

GHSA-xf8r-gcp9-vg22

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xfrm: fix compat ALLOCSPI request use-after-free

xfrm_state_netlink() builds the ALLOCSPI response with dump_one_state(), which already calls alloc_compat() with the response skb and header.

xfrm_alloc_userspi() then calls alloc_compat() again, but passes the original request skb and its header. For a compat request, the translator therefore interprets the 228-byte compat xfrm_userspi_info as the 232-byte native layout and reads four bytes past the declared payload. It also publishes the translated child through the request's frag_list.

A multicast clone of the request shares skb_shared_info and can observe that child. xfrm_user_rcv_msg() frees it after the request handler returns, racing a compat receiver which may still be copying from it and resulting in a use-after-free.

Remove the redundant conversion. The response keeps its correct compat translation from dump_one_state(), and no child is attached to the inbound request.

Affected VersionsENISA

Linux 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 <248433942155b42a0ef04a5806c8aca024ea7c33

Linux 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 <d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320

Linux 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 <494f2bee9d8d0ebcfa249ac41bed7fed26d119b4

Linux patch: 6.6.158

Linux 5.10

Linux 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 <42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810

Linux 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 <e70f639aee2ff0def155c256cace9e0f81d998e2

Linux patch: 5.15.222

Linux 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 <bb63ab52a18273ec68340ac49aebbaa7b514ccd5

Linux patch: 6.1.189

Linux patch: 6.12.112

Linux 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 <17893987e52918c23945c42e47e894a936305a25

Linux patch: 7.2.8

Linux patch: 7.3-rc4

Linux 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 <2b63341e2ebc9b6f73cbd9214dbe7d46dd98c718

Linux patch: 0

Linux patch: 6.18.54

Linux patch: 5.10.271

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 06, 2026 - 10:02 EUVD

CVE Published

Oct 06, 2026 - 08:46 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 94% exploitable

Threat Intel

1 sources

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS NEWS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.