CVE-2026-68426 (GCVE-0-2026-68426)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:04 – Updated: 2026-08-17 05:05
VLAI
Title
xfrm: fix stale skb->prev after async crypto steals a GSO segment
Summary
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list() relies on when it sets its tail pointer (tail = skb->prev). When validate_xmit_xfrm() walks a GSO list and some segments are stolen by async crypto (->xmit() returns -EINPROGRESS), those segments are unlinked from the list but the head ->prev is never updated. If the last segment is the one stolen, the returned head still has ->prev pointing at it, even though it is now owned by the crypto engine and may be freed. validate_xmit_skb_list() later does tail->next = skb, writing through that stale pointer -- a use-after-free. Repoint skb->prev at the last retained segment before returning.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f53c723902d1ac5f0b0a11d7c9dcbff748dde74e , < 33e1b0d25ca0d2818c635ff80e6aa0d295e08a98 (git)
Affected: f53c723902d1ac5f0b0a11d7c9dcbff748dde74e , < bbca7cc3b2b4b10afbfee99b81d9ee78f5423046 (git)
Affected: f53c723902d1ac5f0b0a11d7c9dcbff748dde74e , < 3f4c3919baf0944ad96580467c302bc6c7758b00 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_device.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "33e1b0d25ca0d2818c635ff80e6aa0d295e08a98",
              "status": "affected",
              "version": "f53c723902d1ac5f0b0a11d7c9dcbff748dde74e",
              "versionType": "git"
            },
            {
              "lessThan": "bbca7cc3b2b4b10afbfee99b81d9ee78f5423046",
              "status": "affected",
              "version": "f53c723902d1ac5f0b0a11d7c9dcbff748dde74e",
              "versionType": "git"
            },
            {
              "lessThan": "3f4c3919baf0944ad96580467c302bc6c7758b00",
              "status": "affected",
              "version": "f53c723902d1ac5f0b0a11d7c9dcbff748dde74e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_device.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment\n\nskb_gso_segment() leaves the segment list head with -\u003eprev pointing at\nthe last segment, an invariant validate_xmit_skb_list() relies on when\nit sets its tail pointer (tail = skb-\u003eprev).\n\nWhen validate_xmit_xfrm() walks a GSO list and some segments are stolen\nby async crypto (-\u003exmit() returns -EINPROGRESS), those segments are\nunlinked from the list but the head -\u003eprev is never updated.  If the\nlast segment is the one stolen, the returned head still has -\u003eprev\npointing at it, even though it is now owned by the crypto engine and may\nbe freed.  validate_xmit_skb_list() later does tail-\u003enext = skb, writing\nthrough that stale pointer -- a use-after-free.\n\nRepoint skb-\u003eprev at the last retained segment before returning."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the IPsec transmit path (validate_xmit_xfrm) which processes any skb routed into an offloaded SA, including GRO-aggregated traffic forwarded from remote hosts on an IPsec gateway; xfrm_dev_offload_ok() has no socket/local-origin requirement, so a remote peer\u0027s packet stream drives the vulnerable GSO segmentation and async-crypto steal directly.\nAC:L - The attacker drives both preconditions with traffic alone: sustained large GSO flows keep the crypto engine backlogged so -\u003exmit() returns -EINPROGRESS routinely, and packet volume advances xo-\u003eseq.low toward the wrap that forces segmentation; each stolen trailing segment reproduces the stale skb-\u003eprev, and the subsequent tail-\u003enext write is deterministic once it occurs.\nPR:N - On an IPsec gateway the traffic that triggers the path is forwarded from remote, unauthenticated senders \u2014 no account, credentials, or capability on the target host is needed, since the SA and offload are pre-existing administrative configuration rather than something the attacker must set up.\nUI:N - No victim action is required; the vulnerable code runs automatically in softirq context on every qualifying transmit, driven purely by the attacker\u0027s packet stream.\nS:U - The corruption is of kernel sk_buff list state within the same host kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Writing through the stale -\u003eprev is a use-after-free on an skb whose memory the attacker can influence via heap grooming with concurrent traffic; per kernel UAF guidance this yields a high-confidentiality primitive, and the corrupted list can splice engine-owned skbs into the transmit path, exposing freed/reused memory contents on the wire.\nI:H - tail-\u003enext = skb is an attacker-influenced pointer write into freed heap memory, and the resulting skb list corruption lets live and engine-owned skbs be chained together; this is classic heap corruption that can be shaped via spraying into an arbitrary write or control-flow hijack.\nA:H - Even without full exploitation the use-after-free write and the double-ownership of a stolen segment cause list corruption, double-free/oops and kernel panic in the softirq transmit path, taking down the gateway."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:05:22.080Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/33e1b0d25ca0d2818c635ff80e6aa0d295e08a98"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbca7cc3b2b4b10afbfee99b81d9ee78f5423046"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f4c3919baf0944ad96580467c302bc6c7758b00"
        }
      ],
      "title": "xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68426",
    "datePublished": "2026-08-10T12:04:46.945Z",
    "dateReserved": "2026-07-30T09:28:09.392Z",
    "dateUpdated": "2026-08-17T05:05:22.080Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68426",
      "date": "2026-08-20",
      "epss": "0.00367",
      "percentile": "0.29971"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68426\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:36.540\",\"lastModified\":\"2026-08-17T06:17:51.610\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment\\n\\nskb_gso_segment() leaves the segment list head with -\u003eprev pointing at\\nthe last segment, an invariant validate_xmit_skb_list() relies on when\\nit sets its tail pointer (tail = skb-\u003eprev).\\n\\nWhen validate_xmit_xfrm() walks a GSO list and some segments are stolen\\nby async crypto (-\u003exmit() returns -EINPROGRESS), those segments are\\nunlinked from the list but the head -\u003eprev is never updated.  If the\\nlast segment is the one stolen, the returned head still has -\u003eprev\\npointing at it, even though it is now owned by the crypto engine and may\\nbe freed.  validate_xmit_skb_list() later does tail-\u003enext = skb, writing\\nthrough that stale pointer -- a use-after-free.\\n\\nRepoint skb-\u003eprev at the last retained segment before returning.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/xfrm/xfrm_device.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f53c723902d1ac5f0b0a11d7c9dcbff748dde74e\",\"lessThan\":\"33e1b0d25ca0d2818c635ff80e6aa0d295e08a98\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f53c723902d1ac5f0b0a11d7c9dcbff748dde74e\",\"lessThan\":\"bbca7cc3b2b4b10afbfee99b81d9ee78f5423046\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f53c723902d1ac5f0b0a11d7c9dcbff748dde74e\",\"lessThan\":\"3f4c3919baf0944ad96580467c302bc6c7758b00\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/xfrm/xfrm_device.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/33e1b0d25ca0d2818c635ff80e6aa0d295e08a98\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3f4c3919baf0944ad96580467c302bc6c7758b00\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bbca7cc3b2b4b10afbfee99b81d9ee78f5423046\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-13T23:26:42+00:00",
      "cve": "CVE-2026-68426",
      "id": "CVE-2026-68426",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68426.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-17T16:27:57Z",
      "cve": "CVE-2026-68426",
      "id": "CVE-2026-68426",
      "initial_release_date": "2026-08-11T23:45:37Z",
      "product_status:known_affected": "290",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68426",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68426.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.