Linux kernel strparser: Race condition during parser teardown
Summary
A race condition in the Linux kernel stream parser strparser, used by ESP-in-TCP (espintcp), allows a use-after-free when the parser is torn down while a receive call is still running. A local user with low privileges could potentially escalate privileges to root. The CNA rates it High (CVSS 7.8). Hosts without ESP-in-TCP are much less exposed.
Affected
- Linux kernel from commit e27cca96cd68 up to the fix commits
- OSV: introduced in 5.6, 5.11, 5.16, 6.2 and 6.7 branches
- Kernel 7.3 and later are affected by default per the CNA record, until fixed
- Third-party version ranges differ and are not verified
Fixed in
- Stable kernel fixes per OSV: 5.10.273, 5.15.224, 6.1.191, 6.6.160, 6.12.113, 6.18.57, 7.2.11
- Distribution kernels: Unknown. Check your distributor's advisory, as no verified fixed versions were found.
Workaround
- No vendor workaround found.
- Not vendor-confirmed: if ESP-in-TCP is not needed, do not load or use it. Test this first.
Exploitation
- Not known to be exploited in the wild.
- Not listed in CISA KEV.
- The CVE text states a reproducer was published, but VulDB states no exploit is available. Whether the RustyTux PoC applies to this CVE is unconfirmed; it is linked to CVE-2026-23239.
Our recommendation
- Inventory Linux hosts and kernel versions, and identify systems that use ESP-in-TCP.
- Apply the distribution kernel update when released, and reboot.
- Until patched, restrict local accounts on shared hosts and review container workloads.
- Monitor distributor advisories for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux kernel stable commit 0984ebc6 git.kernel.org
- Linux kernel stable commit 61cc5dac git.kernel.org
- Linux kernel strparser documentation docs.kernel.org
- Ubuntu security tracker ubuntu.com
- OSV Bell-SW entry osv.dev
- Red Hat Bugzilla bugzilla.redhat.com
- VulDB entry vuldb.com
- RustyTux PoC repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:23.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: strparser: make sure __strp_recv isn't running before tearing down the parser The comment above strp_done() claims that if strp is stopped, strp_recv will no longer be called. That's only true if the caller has a mechanism (eg locking) to guarantee that strp_recv() calls that started before strp_stop() have completed by the time we call strp_done(). This adds a dummy lock_sock/release_sock pair to guarantee that any in-flight strp_recv() (which runs under either bh_lock_sock or lock_sock, depending if it's called from ->sk_data_ready or strp_work) has completed. Only espintcp can be affected by this race condition, but this patch makes sure no future user of strp can have the bug. This could crash on strp->sk ("general mode" of strp), but this mode has been here for 9 years and has never been used. It'll be gone soon, no point worrying about it. Switch the stopped/paused/etc bits to u8's to avoid races between strp_stop() and strp_pause/unpause(). A reproducer has been published and turns the possible UAF into an exploit [1].
NVD references (8)
- https://git.kernel.org/stable/c/0984ebc631792acf8fff105112ee74a6b8f1efcc
- https://git.kernel.org/stable/c/61cc5dac60d50dee06cf5c7b7ab246f9c825a715
- https://git.kernel.org/stable/c/933df60a465b1b82ff92dcd6870504da90ba4e9b
- https://git.kernel.org/stable/c/9f3e9fe1b155e9b4572054d8d140586bc3512ecf
- https://git.kernel.org/stable/c/a18dd388045dc7263d99a07db9de4e0f149ca8f1
- https://git.kernel.org/stable/c/b09071e2f8460b35c7d355addad0fc7b31c6904d
- https://git.kernel.org/stable/c/d2b5f637b9b67a79a50d42614d10653c13b4e449
- https://git.kernel.org/stable/c/eaa3a29004c063d7e9d5ea55636f693f67e6db0f
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.