Linux Kernel EUVD-2026-93349

Exploitation requires: (1) local access with the ability to invoke socket operations that reach the xfrm transform path (e.g. IPv6 UDP sends traversing xfrm_lookup_with_ifid / bundle creation), meaning the host must have IPsec/xfrm policies in use for the vulnerable code path to execute; (2) the ability to trigger concurrent net_device teardown via RTM_DELLINK, which typically needs CAP_NET_ADMIN - obtainable by an unprivileged user inside a user+network namespace on kernels permitting unprivileged namespaces; and (3) winning the inherent race window between dst->dev being read without a reference and dst_dev_put() freeing the device. Limiting factors: the attack is local only (not remotely reachable), depends on xfrm being active, requires namespace/network-admin capability to drive device deletion, and is probabilistic due to the timing race - all of which reduce realistic exploitability below the raw 7.8 score.

This is a race-condition use-after-free in the Linux kernel's xfrm (IPsec) transform bundle creation path, carrying a vendor CVSS of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The signals are consistent in pointing away from mass exploitation: EPSS is very low at 0.15% (4th percentile), the CVE is NOT in CISA KEV, and no public exploit or POC is referenced - only upstream git-stable patch commits. The CVSS attack vector is correctly Local (AV:L): the flaw is reached through a local socket operation (udpv6_sendmsg → xfrm_lookup_with_ifid → bundle creation) racing a concurrent RTM_DELLINK that frees the net_device. One signal worth scrutinizing is attack complexity: the vendor rates AC:L, but exploitation fundamentally depends on winning a narrow timing window between bundle creation reading dst->dev and a concurrent device deletion, which in practice is closer to AC:H - a reliable UAF primitive here requires precise scheduling, so I independently assess AC:H. Net judgment: this is a legitimate local privilege-escalation-class kernel bug (UAF can yield memory corruption and code execution), but it is a patch-and-move-on priority for most fleets rather than an emergency - there is no evidence of active or opportunistic exploitation, and the preconditions (configured IPsec/xfrm policy plus the ability to trigger device teardown) meaningfully constrain real-world reach. The 'Information Disclosure' tag understates the issue; the UAF read can be leveraged beyond disclosure toward corruption, consistent with the C:H/I:H/A:H rating.

A local, low-privileged attacker on a host with IPsec/xfrm policies configured issues IPv6 UDP sends that drive xfrm bundle creation while simultaneously triggering network-device deletion (RTM_DELLINK) in a namespace they control. By winning the race, the stale freed net_device is dereferenced in xfrm6_fill_dst, giving a use-after-free that can be shaped into memory corruption and potential local privilege escalation. No public exploit identified at time of analysis, though the report includes a KASAN crash trace from a reproducer.