CVE-2026-63911

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the xfrm: iptfs component where the iptfs clone state() function uses kmemdup() to clone IPTFS mode data. This process incorrectly copies runtime objects—including the embedded sk buff head, hrtimers, spinlock, and in-flight reassembly/reorder state—which should not be shared with the original Security Association (SA). If xfrm state migrate() fails after the cloning process but before init state() reinitializes these fields, the cloned state may be destroyed by xfrm state gc task() using the original SA's list and timer state. This can cause the clone to splice and free socket buffers (skbs) owned by the original IPTFS queue, resulting in use-after-free and double-free conditions during iptfs destroy state() and skb release paths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.