CVE-2013-1826: Linux Kernel

Medium severity, CVSS 6.2. EPSS: 0.5% chance of exploitation in the next 30 days.

The xfrm_state_netlink function in net/xfrm/xfrm_user.c in the Linux kernel before 3.5.7 does not properly handle error conditions in dump_one_state function calls, which allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability.

Affected products

• Linux Linux Kernel: up to and including 3.5.6; version 3.5.1 only; version 3.5.2 only; version 3.5.3 only; version 3.5.4 only; version 3.5.5 only

Published 2013-03-22. Last modified 2026-06-16.