CVE-2026-98561 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux kernel-based systems should assess exposure and verify if their systems are using the affected code paths.

Why it matters

A vulnerability in the Linux kernel has been resolved, where the nfp: hold IPsec RX state under the XArray lock. Linux kernel maintainers and users should assess exposure and verify if their systems are using the affected code paths.

• Verify Linux kernel patch level to determine if the fix is applied.
• Assess the exposure of Linux kernel-based systems to this vulnerability.
• Review system logs for potential exploitation attempts.

Technical summary

The nfp_net_ipsec_rx() function in the Linux kernel drops the XArray lock before taking a reference to the xfrm_state it found, allowing the delete path to erase the entry and drop the last state reference in that interval. The fix involves taking the xfrm_state reference before releasing the XArray lock, which prevents the delete path from erasing the entry and dropping the last state reference. This change ensures that the RX path can safely access the xfrm_state without risking use-after-free errors. Linux kernel maintainers and users should assess exposure and verify if their systems are using the affected code paths.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify if their systems are using the affected code paths.

Recommended defensive actions

• Review Linux kernel source code and patch history to determine if the fix is applied.
• Verify if the system uses the affected nfp_net_ipsec_rx() functionality.
• Assess the exposure of Linux kernel-based systems to this vulnerability.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify versions, exploitation, impact, or remediation. The Linux kernel patch history and source code should be reviewed to determine if the fix is applied and to assess the exposure of Linux kernel-based systems to this vulnerability. The absence of specific version information or known exploitation attempts limits the ability to provide detailed guidance. However, defenders should verify Linux kernel patch levels, review system logs for potential

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.