CVSS 3.1 base metricsRed raises the risk · green lowers it
Attack vector
NetworkAV:N
Attack complexity
LowAC:L
Privileges required
NonePR:N
User interaction
NoneUI:N
Scope
UnchangedS:U
Confidentiality
HighC:H
Integrity
HighI:H
Availability
HighA:H
Updates that fix it
0 KBs
No KB listed
No KB update is listed in the collected MSRC record. Check the MSRC advisory for product releases and other remedies.
Affected products
Open Source Software
1 affected product
azl3 kernel 6.6.157.1-1 on Azure Linux 3.0
What changed
Detection template: Unknown: detection-template evidence is incomplete or retained → No Nuclei template listed
Detection template: No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
Detection template: Unknown: detection-template evidence is incomplete or retained → No Nuclei template listed
Detection template: No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
Detection template: No Nuclei template listed · Customer action: Required: apply the update → Required: follow the MSRC remediation guidance · Public disclosure: No → Unknown: not stated by MSRC · Exploitation detected: Not reported by MSRC → Unknown: not stated by MSRC
Detection template: Unknown: exploit-code evidence is incomplete or retained → No Nuclei template listed · CISA KEV: Unknown: catalog evidence is incomplete or retained → Not listed in the collected catalog
Detection template: No Nuclei template listed → Unknown: exploit-code evidence is incomplete or retained · CISA KEV: Not listed in the collected catalog → Unknown: catalog evidence is incomplete or retained
Page history
Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.
CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.
No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.
cve-program · CVE-2026-98370
Published
xfrm: fix compat ALLOCSPI request use-after-free
In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix compat ALLOCSPI request use-after-free
xfrm_state_netlink() builds the ALLOCSPI response with
dump_one_state(), which already calls alloc_compat() with the response
skb and header.
xfrm_alloc_userspi() then calls alloc_compat() again, but passes the
original request skb and its header. For a compat request, the
translator therefore interprets the 228-byte compat xfrm_userspi_info
as the 232-byte native layout and reads four bytes past the declared
payload. It also publishes the translated child through the request's
frag_list.
A multicast clone of the request shares skb_shared_info and can observe
that child. xfrm_user_rcv_msg() frees it after the request handler
returns, racing a compat receiver which may still be copying from it and
resulting in a use-after-free.
Remove the redundant conversion. The response keeps its correct compat
translation from dump_one_state(), and no child is attached to the
inbound request.
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.