CVE-2026-80846Medium· 5.1▾ SunlitA flaw was found in the Linux kernel's xfrm subsystem, which handles ESP-in-TCP packets. When queued ESP-in-TCP data is processed after its ingress network device has been removed, the system attempts to dereference a null pointer. This ca…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 28.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
Last analysed / modified upstream
— → 5.1
none → medium
A flaw was found in the Linux kernel's xfrm subsystem, which handles ESP-in-TCP packets. When queued ESP-in-TCP data is processed after its ingress network device has been removed, the system attempts to dereference a null pointer. This can lead to a system crash, resulting in a Denial of Service (DoS).
kernel: xfrm: drop ESP-in-TCP packets with no ingress device — rated Moderate by Red Hat. Released 2026-09-04, updated 2026-10-25.
Affected:
No fix planned:
Not affected:
Fix deferred
Workarounds / mitigations:
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-98876Medium· 4.1kernel: host1x: bus: Fix missing ops null check in error teardown (CVE-2026-98876)
CVE-2026-98877Medium· 4.7kernel: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed (CVE-2026-98877)
CVE-2026-98747Medium· 4.4kernel: serial: core: fix NULL pointer dereference in serial_core_unregister_port() (CVE-2026-98747)
CVE-2026-98785Medium· 4.7kernel: drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend (CVE-2026-98785)
CVE-2026-98786Medium· 4.7kernel: drm/amd/display: guard dc_sink dereferences in MST mode validation (CVE-2026-98786)
CVE-2026-98791Medium· 4.4kernel: net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference (CVE-2026-98791)