CVE-2026-68415 (GCVE-0-2026-68415)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:04 – Updated: 2026-08-17 05:05
VLAI
Title
xfrm: clear mode callbacks after failed mode setup
Summary
In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup xfrm_state_gc_task can run long after a failed IPTFS state setup. In the reproduced case, __xfrm_init_state() cached x->mode_cbs, IPTFS setup returned -ENOMEM before publishing mode_data, and the temporary module reference from xfrm_get_mode_cbs() was dropped immediately. The dead state then kept x->mode_cbs until deferred GC ran after xfrm_iptfs had been unloaded. Clear x->mode_cbs when mode init or clone fails before publishing mode_data. Those states never installed mode-specific state or the long-term IPTFS module pin, so deferred GC has nothing mode-specific to destroy and must not retain a callback table pointer past the temporary lookup reference. The buggy scenario involves two paths, with each column showing the order within that path: failed setup path: 1. cache x->mode_cbs 2. mode setup fails before mode_data 3. drop the temporary module ref 4. dead state keeps x->mode_cbs cached GC/unload path: 1. xfrm_state_put() queues GC work 2. xfrm_iptfs unloads later 3. xfrm_state_gc_task runs 4. GC dereferences stale x->mode_cbs This also covers the failed clone path where clone_state() returns before publishing mode_data. Validation reproduced this kernel report: Kernel panic - not syncing: Fatal exception CONFIG_FAULT_INJECTION_STACKTRACE_FILTER=y failslab_stacktrace_filter matched xfrm_iptfs frames ack_error=-12 FAULT_INJECTION: forcing a failure BUG: unable to handle page fault Workqueue: events xfrm_state_gc_task RIP: xfrm_state_gc_task+0x142/0x650 Modules linked in: esp4_offload xfrm_user [last unloaded: xfrm_iptfs] Kernel panic - not syncing: Fatal exception
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4b3faf610cc63bfac972711635eafbca5e7d7117 , < 9845a35986a658816f7752f7ebd7c455a4c7dfdf (git)
Affected: 4b3faf610cc63bfac972711635eafbca5e7d7117 , < c37a079230128a5237f45fb4e181bc069a5c2955 (git)
Affected: 4b3faf610cc63bfac972711635eafbca5e7d7117 , < 2538bd3cd1ff5af655908469544ac7b7ae259386 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9845a35986a658816f7752f7ebd7c455a4c7dfdf",
              "status": "affected",
              "version": "4b3faf610cc63bfac972711635eafbca5e7d7117",
              "versionType": "git"
            },
            {
              "lessThan": "c37a079230128a5237f45fb4e181bc069a5c2955",
              "status": "affected",
              "version": "4b3faf610cc63bfac972711635eafbca5e7d7117",
              "versionType": "git"
            },
            {
              "lessThan": "2538bd3cd1ff5af655908469544ac7b7ae259386",
              "status": "affected",
              "version": "4b3faf610cc63bfac972711635eafbca5e7d7117",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: clear mode callbacks after failed mode setup\n\nxfrm_state_gc_task can run long after a failed IPTFS state setup. In the\nreproduced case, __xfrm_init_state() cached x-\u003emode_cbs, IPTFS setup\nreturned -ENOMEM before publishing mode_data, and the temporary module\nreference from xfrm_get_mode_cbs() was dropped immediately. The dead state\nthen kept x-\u003emode_cbs until deferred GC ran after xfrm_iptfs had been\nunloaded.\n\nClear x-\u003emode_cbs when mode init or clone fails before publishing\nmode_data. Those states never installed mode-specific state or the\nlong-term IPTFS module pin, so deferred GC has nothing mode-specific to\ndestroy and must not retain a callback table pointer past the temporary\nlookup reference.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nfailed setup path:\n1. cache x-\u003emode_cbs\n2. mode setup fails before mode_data\n3. drop the temporary module ref\n4. dead state keeps x-\u003emode_cbs cached\n\nGC/unload path:\n1. xfrm_state_put() queues GC work\n2. xfrm_iptfs unloads later\n3. xfrm_state_gc_task runs\n4. GC dereferences stale x-\u003emode_cbs\n\nThis also covers the failed clone path where clone_state() returns before\npublishing mode_data.\n\nValidation reproduced this kernel report:\nKernel panic - not syncing: Fatal exception\nCONFIG_FAULT_INJECTION_STACKTRACE_FILTER=y\nfailslab_stacktrace_filter matched xfrm_iptfs frames\nack_error=-12\nFAULT_INJECTION: forcing a failure\nBUG: unable to handle page fault\nWorkqueue: events xfrm_state_gc_task\nRIP: xfrm_state_gc_task+0x142/0x650\nModules linked in: esp4_offload xfrm_user [last unloaded: xfrm_iptfs]\nKernel panic - not syncing: Fatal exception"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable paths are reached only through the XFRM configuration interface \u2014 netlink XFRM_MSG_NEWSA/XFRM_MSG_MIGRATE handled by xfrm_user.c \u2014 which requires a local socket on the machine; no remote peer data reaches this code.\nAC:L - The attacker fully controls SA creation and the failing allocation size (XFRMA_IPTFS_REORDER_WINDOW up to 65535 slots, ~1MB order-8 kmalloc), so the -ENOMEM setup failure is attacker-inducible and repeatable, and unlimited poisoned dead states can be armed so the stale x-\u003emode_cbs dereference in xfrm_state_gc_task is hit deterministically once xfrm_iptfs is unloaded.\nPR:L - xfrm_user_rcv_msg() gates on netlink_net_capable(skb, CAP_NET_ADMIN), which is evaluated against the net namespace\u0027s user_ns, so any unprivileged local user obtains it with `unshare -Urn`; the IPTFS module is auto-loaded on demand by xfrm_get_mode_cbs().\nUI:N - The attacker performs the entire sequence with netlink messages from its own process; no victim action, mount, or file open is needed to arm or trigger the dead state\u0027s deferred GC.\nS:U - The stale callback dereference occurs in kernel context within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - xfrm_state_gc_task loads x-\u003emode_cbs-\u003edestroy_state from module memory that was freed by module unload and can be reoccupied by attacker-influenced allocations, giving a stale-pointer read/indirect-call primitive that can be leveraged to disclose arbitrary kernel memory.\nI:H - Calling a function pointer read out of freed module text/rodata is a control-flow hijack primitive; combined with the missing module reference that lets the memory be recycled, this permits arbitrary kernel-state modification rather than a benign fault.\nA:H - The commit\u0027s reproducer shows the direct outcome is \"BUG: unable to handle page fault\" in the events workqueue running xfrm_state_gc_task, escalating to \"Kernel panic - not syncing: Fatal exception\" \u2014 a full system crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:05:09.173Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9845a35986a658816f7752f7ebd7c455a4c7dfdf"
        },
        {
          "url": "https://git.kernel.org/stable/c/c37a079230128a5237f45fb4e181bc069a5c2955"
        },
        {
          "url": "https://git.kernel.org/stable/c/2538bd3cd1ff5af655908469544ac7b7ae259386"
        }
      ],
      "title": "xfrm: clear mode callbacks after failed mode setup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68415",
    "datePublished": "2026-08-10T12:04:35.425Z",
    "dateReserved": "2026-07-30T09:28:09.391Z",
    "dateUpdated": "2026-08-17T05:05:09.173Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68415",
      "date": "2026-09-20",
      "epss": "0.00134",
      "percentile": "0.03276"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/xfrm/xfrm_state.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "9845a35986a658816f7752f7ebd7c455a4c7dfdf",
                    "status": "affected",
                    "version": "4b3faf610cc63bfac972711635eafbca5e7d7117",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c37a079230128a5237f45fb4e181bc069a5c2955",
                    "status": "affected",
                    "version": "4b3faf610cc63bfac972711635eafbca5e7d7117",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2538bd3cd1ff5af655908469544ac7b7ae259386",
                    "status": "affected",
                    "version": "4b3faf610cc63bfac972711635eafbca5e7d7117",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/xfrm/xfrm_state.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.14"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: clear mode callbacks after failed mode setup\n\nxfrm_state_gc_task can run long after a failed IPTFS state setup. In the\nreproduced case, __xfrm_init_state() cached x-\u003emode_cbs, IPTFS setup\nreturned -ENOMEM before publishing mode_data, and the temporary module\nreference from xfrm_get_mode_cbs() was dropped immediately. The dead state\nthen kept x-\u003emode_cbs until deferred GC ran after xfrm_iptfs had been\nunloaded.\n\nClear x-\u003emode_cbs when mode init or clone fails before publishing\nmode_data. Those states never installed mode-specific state or the\nlong-term IPTFS module pin, so deferred GC has nothing mode-specific to\ndestroy and must not retain a callback table pointer past the temporary\nlookup reference.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nfailed setup path:\n1. cache x-\u003emode_cbs\n2. mode setup fails before mode_data\n3. drop the temporary module ref\n4. dead state keeps x-\u003emode_cbs cached\n\nGC/unload path:\n1. xfrm_state_put() queues GC work\n2. xfrm_iptfs unloads later\n3. xfrm_state_gc_task runs\n4. GC dereferences stale x-\u003emode_cbs\n\nThis also covers the failed clone path where clone_state() returns before\npublishing mode_data.\n\nValidation reproduced this kernel report:\nKernel panic - not syncing: Fatal exception\nCONFIG_FAULT_INJECTION_STACKTRACE_FILTER=y\nfailslab_stacktrace_filter matched xfrm_iptfs frames\nack_error=-12\nFAULT_INJECTION: forcing a failure\nBUG: unable to handle page fault\nWorkqueue: events xfrm_state_gc_task\nRIP: xfrm_state_gc_task+0x142/0x650\nModules linked in: esp4_offload xfrm_user [last unloaded: xfrm_iptfs]\nKernel panic - not syncing: Fatal exception"
          }
        ],
        "id": "CVE-2026-68415",
        "lastModified": "2026-08-17T06:17:50.483",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:20:35.253",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2538bd3cd1ff5af655908469544ac7b7ae259386"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9845a35986a658816f7752f7ebd7c455a4c7dfdf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c37a079230128a5237f45fb4e181bc069a5c2955"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:27:31+00:00",
      "cve": "CVE-2026-68415",
      "id": "CVE-2026-68415",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_not_affected": "277",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xfrm: clear mode callbacks after failed mode setup",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68415.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-11T23:46:04Z",
      "cve": "CVE-2026-68415",
      "id": "CVE-2026-68415",
      "initial_release_date": "2026-08-11T23:46:04Z",
      "product_status:known_not_affected": "296",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68415",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68415.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.