SB20260812104 - Use-after-free in Linux kernel xfrm

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-68415)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in xfrm_state_gc_task and xfrm state mode callback handling when processing a failed IPTFS state setup or failed clone before publishing mode_data. A local user can trigger state setup failure and deferred garbage collection to cause a denial of service.

The issue occurs because a dead state can retain a stale mode callback table pointer after the temporary module reference is dropped, and the fault can be triggered later when garbage collection runs after the xfrm_iptfs module has been unloaded.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2538bd3cd1ff5af655908469544ac7b7ae259386
• https://git.kernel.org/stable/c/9845a35986a658816f7752f7ebd7c455a4c7dfdf
• https://git.kernel.org/stable/c/c37a079230128a5237f45fb4e181bc069a5c2955