{"id":"CVE-2026-80846","revision":"11f0c28abbe14cf58a91704b3cf2ba3d","records":[{"revision":"11f0c28abbe14cf58a91704b3cf2ba3d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-80846","aliases":[],"title":"xfrm: drop ESP-in-TCP packets with no ingress device","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: drop ESP-in-TCP packets with no ingress device\n\nESP-in-TCP receives records through the TCP strparser. handle_esp()\nrestores skb->dev from the saved skb_iif before passing the packet into\nthe XFRM input path.\n\nQueued TCP data can be processed after the original ingress device has\nbeen removed, for example during veth or net namespace teardown. In that\ncase dev_get_by_index_rcu() returns NULL. The XFRM IPv4 and IPv6 input\npaths both expect skb->dev to be valid while building the route lookup,\nso queued ESP-in-TCP data can dereference a NULL device.\n\nDrop the packet if the saved ingress device can no longer be resolved.\nSuch a packet can no longer be routed through the normal XFRM receive\npath, and this preserves the existing behaviour for packets whose ingress\ndevice still exists.","state":0,"publishedAt":"2026-09-04T15:54:56.492+00:00","modifiedAt":"2026-10-19T08:44:40.508+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/xfrm/espintcp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593\",\n                            \"lessThan\": \"239d0f71af09dc2029fd4d730cb24b8c83aaa43a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593\",\n                            \"lessThan\": \"f00235f9d12301183d61f75fbe4105506f3e5140\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593\",\n                            \"lessThan\": \"6af5cdb03819a5ce6e945992635c6c5e91045367\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593\",\n                            \"lessThan\": \"2dd1609cadff46c4b20ce53b91ab9cce1380456a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593\",\n                            \"lessThan\": \"c296d25efbc840be24de83f56d43bc47e714ace9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593\",\n                            \"lessThan\": \"328e40aa774b446969c69b654c52a051a95af8a1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593\",\n                            \"lessThan\": \"7911e0236616487b89db6bd3ba3f408abd10eb23\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593\",\n                            \"lessThan\": \"943d95233b8b4a88994e244fcf466f8c403d63f1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593\",\n                            \"lessThan\": \"e1d7c5ac1c246ce5775f604515de0a59fbf2116e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/xfrm/espintcp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.6\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.6\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.269\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.220\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.187\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.156\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.108\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.49\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.13\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.3\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/239d0f71af09dc2029fd4d730cb24b8c83aaa43a","https://git.kernel.org/stable/c/f00235f9d12301183d61f75fbe4105506f3e5140","https://git.kernel.org/stable/c/6af5cdb03819a5ce6e945992635c6c5e91045367","https://git.kernel.org/stable/c/2dd1609cadff46c4b20ce53b91ab9cce1380456a","https://git.kernel.org/stable/c/c296d25efbc840be24de83f56d43bc47e714ace9","https://git.kernel.org/stable/c/328e40aa774b446969c69b654c52a051a95af8a1","https://git.kernel.org/stable/c/7911e0236616487b89db6bd3ba3f408abd10eb23","https://git.kernel.org/stable/c/943d95233b8b4a88994e244fcf466f8c403d63f1","https://git.kernel.org/stable/c/e1d7c5ac1c246ce5775f604515de0a59fbf2116e"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80846","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-80846","identifiers":["CVE-2026-80846"]},"retained":false,"historicalAffected":[]}],"coverage":[]}