CVE-2026-98369

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()<br /> <br /> syzbot reported a suspicious RCU usage warning in ip6_pkt_drop():<br /> <br /> WARNING: suspicious RCU usage in ip6_pkt_drop<br /> include/net/addrconf.h:389 suspicious rcu_dereference_check() usage!<br /> <br /> Call Trace:<br /> __in6_dev_get_safely include/net/addrconf.h:389 [inline]<br /> ip6_pkt_drop+0x596/0x610 net/ipv6/route.c:4620<br /> ip6_pkt_discard+0x1c/0x30 net/ipv6/route.c:4651<br /> xfrm_trans_reinject+0x324/0x630 net/xfrm/xfrm_input.c:806<br /> process_one_work kernel/workqueue.c:3322 [inline]<br /> process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405<br /> worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486<br /> <br /> When commit 4f4920669d21 ("xfrm: Reinject transport-mode packets through<br /> workqueue") converted xfrm_trans_reinject from a tasklet to a workqueue,<br /> the reinjection loop ceased running in softirq context. Workqueue workers<br /> run in process context where local_bh_disable() does not enter an RCU<br /> read-side critical section under CONFIG_PREEMPT_RCU.<br /> <br /> Because finish callbacks (such as ip6_rcv_finish) expect to run under an<br /> RCU read lock (performing route lookups, l3mdev lookups, and accessing<br /> RCU-protected data structures), invoking them in workqueue context without<br /> rcu_read_lock() triggers RCU lockdep warnings.<br /> <br /> Furthermore, packets queued to the workqueue via xfrm_trans_queue_net()<br /> may carry non-refcounted (noref) dst entries (e.g. from ip_route_input_noref).<br /> Additionally, on netdevice unregistration, dst_dev_put() replaces dst-&gt;dev<br /> with blackhole_netdev, so dst entries do not keep skb-&gt;dev alive while<br /> queued in the workqueue.<br /> <br /> Fix these issues by:<br /> 1. Calling skb_dst_force(skb) in xfrm_trans_queue_net() while still in the<br /> caller&amp;#39;s RCU section to ensure dst is reference-counted before queuing.<br /> 2. Holding a reference on skb-&gt;dev via dev_hold()/dev_put() across workqueue<br /> deferral so skb-&gt;dev remains valid during finish() callback processing.<br /> 3. Acquiring rcu_read_lock() around the finish callback invocation loop in<br /> xfrm_trans_reinject().