Linux Kernel CVE-2026-99056

Exploitation requires that the host actually use espintcp (IPsec encapsulated in TCP) - the changelog explicitly states this is the only strparser consumer affected, and the alternative strp 'general mode' on strp->sk has never been used. The attacker must hold a local, low-privileged account (CVSS PR:L, AV:L) and must win a race between an in-flight __strp_recv() (running under bh_lock_sock or lock_sock) and parser teardown via strp_done(). Limiting factors: no network vector (local access mandatory), no remote/unauthenticated path, and exposure is gated on the espintcp feature being configured and in use rather than on a default kernel configuration; hosts not using espintcp are not reachable through this flaw.

Signals point in two directions and should be reconciled carefully. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a locally-reachable, low-privilege kernel use-after-free with full confidentiality/integrity/availability impact - a classic local privilege-escalation profile, not a remote-network threat. Against that, the EPSS score is only 0.21% (10th percentile), and the CVE is NOT listed in CISA KEV, so there is no evidence of widespread or confirmed active exploitation. The counterweight is the kernel changelog itself, which states that a reproducer has been published that turns the possible UAF into a working exploit; this raises practical concern well above what the low EPSS alone would suggest, because exploit maturity for the local LPE case appears high. The vuln.today decision label is 'this_week', consistent with a serious-but-not-emergency local kernel flaw. The most important scoping fact is in the description: only the espintcp (IPsec-over-TCP) consumer of strparser is actually affected, and the vulnerable strp 'general mode' has never been used in 9 years - so real-world exposure is confined to hosts that use espintcp. Net: a genuine, exploit-backed local kernel UAF worth prompt patching on affected hosts, but the low EPSS and absence from KEV indicate it is not (yet) broadly exploited, and the local-only, espintcp-scoped vector limits mass-exploitation risk.

A local, low-privileged user on a Linux host that uses espintcp races an in-flight __strp_recv() against strparser teardown (strp_done), triggering a use-after-free on the strparser's socket state. Per the kernel changelog a reproducer has been published that develops this UAF into a working exploit, enabling kernel-context code execution or a crash from an unprivileged account.