A use-after-free vulnerability exists in the Linux kernel's strparser subsystem when handling ESP-in-TCP (espintcp). During espintcp_close(), msg_timer_work can be re-armed by a concurrent strp_data_ready() execution after it has been cancelled. The re-armed timer may subsequently access the freed socket context, causing a use-after-free condition.
A use-after-free vulnerability was found in the Linux kernel's strparser subsystem (net/strparser/strparser.c), reachable via ESP-in-TCP (espintcp).
When espintcp_close() calls strp_done() to tear down the stream parser, it cancels msg_timer_work via cancel_delayed_work_sync(). However, strp_data_ready() can concurrently run on another CPU and pass the strp->stopped check before strp_stop() sets it. This allows strp_recv() to re-arm msg_timer_work via mod_delayed_work() after cancellation has completed. When the socket context is subsequently freed, the re-armed
timer fires against freed memory, resulting in a use-after-free. The vulnerable code path is reachable by an unprivileged local user was introduced in commit bbb03029a899 ("strparser: Generalize strparser").
Upstream patch (not yet merged):
https://lore.kernel.org/all/aZgpkyTDU3aXe_V0@v4bel/
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
Via RHSA-2026:85000 https://access.redhat.com/errata/RHSA-2026:85000
A use-after-free vulnerability was found in the Linux kernel's strparser subsystem (net/strparser/strparser.c), reachable via ESP-in-TCP (espintcp). When espintcp_close() calls strp_done() to tear down the stream parser, it cancels msg_timer_work via cancel_delayed_work_sync(). However, strp_data_ready() can concurrently run on another CPU and pass the strp->stopped check before strp_stop() sets it. This allows strp_recv() to re-arm msg_timer_work via mod_delayed_work() after cancellation has completed. When the socket context is subsequently freed, the re-armed timer fires against freed memory, resulting in a use-after-free. The vulnerable code path is reachable by an unprivileged local user was introduced in commit bbb03029a899 ("strparser: Generalize strparser"). Upstream patch (not yet merged): https://lore.kernel.org/all/aZgpkyTDU3aXe_V0@v4bel/