CVE-2026-80848: linux

CVSS: UnknownReceived
AliasesUBUNTU-CVE-2026-80848DEBIAN-CVE-2026-80848
Published 04-09-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-80848 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.7% of scored vulnerabilities.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.19%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 10
MGASA-2026-0506OPENSUSE-SU-2026:11773-1OPENSUSE-SU-2026:22091-1SUSE-SU-2026:24179-1SUSE-SU-2026:24181-1SUSE-SU-2026:24182-1

Timeline

  1. 04-09-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: fix UAF during close ZDI reported and analyzed a race condition during close for espintcp sockets: espintcp_close() frees emsg->skb via kfree_skb() without holding any socket lock. Concurrently, the xfrm_trans_reinject work queue invokes esp_output_tcp_finish() -> espintcp_push_skb() -> espintcp_push_msgs() -> skb_send_sock_locked(), which reads the same skb as a data source. Fix this by adding a synchronize_rcu() call after resetting sk_prot, since esp_output_tcp_finish() runs under RCU and won't use a socket with sk_prot == &tcp_prot. Simply taking the socket lock in espintcp_close() could lead to leaks, if esp_output_tcp_finish() re-adds an skb in the slot we just freed. After this, the existing barrier() is no longer needed.

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.19%

Chance of exploitation in the next 30 days

Percentile

9%

Versus all other CVEs

30-day change

0.00 pp

From 0.19% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.19%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu157 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.1.187-1 | < 6.12.111-1 | < 7.1.13-1
  • linux-6.12< 6.12.111-1~deb12u1
Linux1 product
  • linux≥ e27cca96cd68fa2c6814c90f9a1cfd36bb68c593, < 29121c5e6591da527e8e36ddac7120dc527f574d | ≥ e27cca96cd68fa2c6814c90f9a1cfd36bb68c593, < ed5d9102190c45fc70121c036b0626b740040b75 | ≥ e27cca96cd68fa2c6814c90f9a1cfd36bb68c593, < 4bc0dfa28dca6fc0084203732695968049c44072 | ≥ e27cca96cd68fa2c6814c90f9a1cfd36bb68c593, < ff8dd7a932f34409a56e1b91a1219340f17457e9 | ≥ e27cca96cd68fa2c6814c90f9a1cfd36bb68c593, < 4b31a875693c480c611519faca46216514e3e052 | ≥ e27cca96cd68fa2c6814c90f9a1cfd36bb68c593, < 24efebecf415ba264adba0f0491cec436463a14f | ≥ e27cca96cd68fa2c6814c90f9a1cfd36bb68c593, < eb3bbf29c723fe75c0eb92be14f0ec92971fe272 | ≥ e27cca96cd68fa2c6814c90f9a1cfd36bb68c593, < 54b41ad14da9a981131ab6e4d3f79321a503ea5d | ≥ e27cca96cd68fa2c6814c90f9a1cfd36bb68c593, < deb232e884877bf10b4ce2580909eedec986c284 | 5.6

3 vendors · 160 products

References

13 links
Show all 13 references