CVE-2026-68415

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the xfrm component where the xfrm state gc task can run after a failed IPTFS state setup. Specifically, the xfrm init state() function caches x->mode cbs, but if the IPTFS setup fails (for example, returning -ENOMEM) before publishing mode data, the temporary module reference from xfrm get mode cbs() is dropped. This leaves the dead state retaining x->mode cbs until the deferred Garbage Collection (GC) runs. If the xfrm iptfs module is unloaded before the GC task executes, the xfrm state gc task dereferences a stale x->mode cbs pointer, leading to a kernel panic and page fault. This issue also affects the failed clone path when clone state() returns before publishing mode data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.