CVE-2026-68377

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race-condition use-after-free exists in the tunnel key release params() function. The issue occurs because the function releases the metadata dst of old parameters synchronously via dst release(), while the parameters structure itself is freed using kfree rcu(). A concurrent reader in tunnel key act() on the datapath may still hold a pointer to the old parameters and attempt to call dst clone() on the dst member of tcft enc metadata after the writer has already marked the destination as dead.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.