CVE-2026-68420

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the xfrm module where optional IPTFS templates in outbound policies can trigger a stack-out-of-bounds read. This occurs in the xfrm state find() function, which is reached via xfrm tmpl resolve one(). While previous fixes disallowed optional tunnel and BEET modes in outbound policies to prevent similar issues, IPTFS was not initially covered, leaving it susceptible to the same out-of-bounds read. This issue only affects outbound policies, as xfrm tmpl resolve one() is not reachable via IN or FWD paths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.