CVE-2026-63911
Received Received - Intake

Use-After-Free in Linux Kernel xfrm iptfs

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: reset runtime state when cloning SAs iptfs_clone_state() clones the IPTFS mode data with kmemdup(). This copies runtime objects which must not be shared with the original SA, including the embedded sk_buff_head, hrtimers, spinlock, and in-flight reassembly/reorder state. If xfrm_state_migrate() fails after clone_state() but before the later init_state() call has reinitialized those fields, the cloned state can be destroyed by xfrm_state_gc_task() with list and timer state copied from the original SA. With queued packets this lets the clone splice and free skbs owned by the original IPTFS queue, leading to use-after-free and double-free reports in iptfs_destroy_state() and skb release paths. Reinitialize the clone's runtime state before publishing it through x->mode_data. Because clone_state() now publishes a destroyable mode_data object before init_state(), take the mode callback module reference there. Avoid taking it again from __iptfs_init_state() for the same object.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63911
EUVD
EUVD-2026-45684

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free and double-free vulnerability in the Linux kernel's xfrm subsystem, specifically in the IPTFS (IP Traffic Flow Security) mode. It occurs when cloning security associations (SAs) where runtime state like sk_buff_head, hrtimers, and spinlocks are improperly copied. If migration fails after cloning but before reinitialization, the cloned state can be destroyed while still referencing the original SA's data, leading to memory corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's xfrm subsystem and IPTFS mode. Detection requires checking kernel logs for use-after-free or double-free errors in iptfs_destroy_state() or skb release paths. Monitor for crashes or kernel panics related to xfrm_state operations.

Impact Analysis

This vulnerability could allow an attacker to cause system crashes, memory corruption, or execute arbitrary code with kernel privileges. It may lead to denial-of-service conditions or privilege escalation on affected Linux systems using IPTFS.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel memory corruption issue in the xfrm subsystem. Compliance impacts would depend on system-specific implementations and whether the vulnerability leads to data breaches or unauthorized access, which is not described here.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this use-after-free and double-free vulnerability in the IPTFS mode of xfrm subsystem.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63911. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart