CVE-2026-68426

Received Received - Intake

xfrm skb list corruption in Linux kernel

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list() relies on when it sets its tail pointer (tail = skb->prev). When validate_xmit_xfrm() walks a GSO list and some segments are stolen by async crypto (->xmit() returns -EINPROGRESS), those segments are unlinked from the list but the head ->prev is never updated. If the last segment is the one stolen, the returned head still has ->prev pointing at it, even though it is now owned by the crypto engine and may be freed. validate_xmit_skb_list() later does tail->next = skb, writing through that stale pointer -- a use-after-free. Repoint skb->prev at the last retained segment before returning.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68426

EUVD

EUVD-2026-55612

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the xfrm (IPsec) subsystem. When async crypto steals a GSO segment during transmission, the skb->prev pointer in the segment list head becomes stale, pointing to a freed segment. This leads to a use-after-free when validate_xmit_skb_list() writes through the invalid pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's xfrm subsystem and involves a use-after-free condition in GSO segment handling. Detection requires checking kernel logs for crashes or memory corruption related to xfrm or GSO operations. Commands like dmesg | grep -i xfrm or journalctl -k | grep -i xfrm may help identify issues. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service or execute arbitrary code with kernel privileges. It affects systems using IPsec with async crypto offloading, potentially leading to system crashes or unauthorized access.

Compliance Impact

This vulnerability is a Linux kernel issue related to network packet handling and does not directly impact compliance with standards like GDPR or HIPAA. It involves a use-after-free flaw in the xfrm subsystem during GSO segment processing, which could lead to system instability or crashes but does not inherently affect data protection or privacy controls required by these regulations.

Mitigation Strategies

Immediately update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If updating is not immediately possible, consider disabling GSO (Generic Segmentation Offload) or xfrm features temporarily as a workaround, though this may impact network performance.

Hi! I’m here to help you understand CVE-2026-68426. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70