CVE-2026-53240

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload

__input_process_payload() stores first_skb into xtfs->ra_newskb under

drop_lock when starting partial reassembly, then unlocks and breaks out

of the processing loop. The post-loop check reads xtfs->ra_newskb

without the lock to decide whether first_skb is still owned:

if (first_skb && first_iplen && !defer && first_skb != xtfs->ra_newskb)

Between spin_unlock and this read, a concurrent CPU running

iptfs_reassem_cont() (or the drop_timer hrtimer) can complete

reassembly, NULL xtfs->ra_newskb, and free the skb. The check then

evaluates first_skb != NULL as true, and pskb_trim/ip_summed/consume_skb

operate on the freed skb — a use-after-free in skbuff_head_cache.

Replace the unlocked read with a local bool that records whether

first_skb was handed to the reassembly state in the current call. The

flag is set after the existing spin_unlock, bef

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References