PT-2026-61228 · Linux · Linux
CVE-2026-63911
·
Published
2026-07-19
·
Updated
2026-07-19
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
xfrm: iptfs: reset runtime state when cloning SAs
iptfs clone state() clones the IPTFS mode data with kmemdup(). This
copies runtime objects which must not be shared with the original SA,
including the embedded sk buff head, hrtimers, spinlock, and in-flight
reassembly/reorder state.
If xfrm state migrate() fails after clone state() but before the later
init state() call has reinitialized those fields, the cloned state can be
destroyed by xfrm state gc task() with list and timer state copied from the
original SA. With queued packets this lets the clone splice and free skbs
owned by the original IPTFS queue, leading to use-after-free and
double-free reports in iptfs destroy state() and skb release paths.
Reinitialize the clone's runtime state before publishing it through
x->mode data. Because clone state() now publishes a destroyable mode data
object before init state(), take the mode callback module reference there.
Avoid taking it again from iptfs init state() for the same object.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux