GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-63911 (GCVE-0-2026-63911)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37
VLAI
Title
xfrm: iptfs: reset runtime state when cloning SAs
Summary
In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: reset runtime state when cloning SAs iptfs_clone_state() clones the IPTFS mode data with kmemdup(). This copies runtime objects which must not be shared with the original SA, including the embedded sk_buff_head, hrtimers, spinlock, and in-flight reassembly/reorder state. If xfrm_state_migrate() fails after clone_state() but before the later init_state() call has reinitialized those fields, the cloned state can be destroyed by xfrm_state_gc_task() with list and timer state copied from the original SA. With queued packets this lets the clone splice and free skbs owned by the original IPTFS queue, leading to use-after-free and double-free reports in iptfs_destroy_state() and skb release paths. Reinitialize the clone's runtime state before publishing it through x->mode_data. Because clone_state() now publishes a destroyable mode_data object before init_state(), take the mode callback module reference there. Avoid taking it again from __iptfs_init_state() for the same object.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0e4fbf013fa566f274ce9b4ce698c75b1f998c52 , < 9327252e04626d4bb02ca8c0c108fbe8eabf0c5a (git)
Affected: 0e4fbf013fa566f274ce9b4ce698c75b1f998c52 , < dfb9f6cbfa9826655a49698cf90eb800fce2178e (git)
Affected: 0e4fbf013fa566f274ce9b4ce698c75b1f998c52 , < 7f83d174073234839aea176f265e517e0d50a1d2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_iptfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9327252e04626d4bb02ca8c0c108fbe8eabf0c5a",
              "status": "affected",
              "version": "0e4fbf013fa566f274ce9b4ce698c75b1f998c52",
              "versionType": "git"
            },
            {
              "lessThan": "dfb9f6cbfa9826655a49698cf90eb800fce2178e",
              "status": "affected",
              "version": "0e4fbf013fa566f274ce9b4ce698c75b1f998c52",
              "versionType": "git"
            },
            {
              "lessThan": "7f83d174073234839aea176f265e517e0d50a1d2",
              "status": "affected",
              "version": "0e4fbf013fa566f274ce9b4ce698c75b1f998c52",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_iptfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: iptfs: reset runtime state when cloning SAs\n\niptfs_clone_state() clones the IPTFS mode data with kmemdup(). This\ncopies runtime objects which must not be shared with the original SA,\nincluding the embedded sk_buff_head, hrtimers, spinlock, and in-flight\nreassembly/reorder state.\n\nIf xfrm_state_migrate() fails after clone_state() but before the later\ninit_state() call has reinitialized those fields, the cloned state can be\ndestroyed by xfrm_state_gc_task() with list and timer state copied from the\noriginal SA. With queued packets this lets the clone splice and free skbs\nowned by the original IPTFS queue, leading to use-after-free and\ndouble-free reports in iptfs_destroy_state() and skb release paths.\n\nReinitialize the clone\u0027s runtime state before publishing it through\nx-\u003emode_data. Because clone_state() now publishes a destroyable mode_data\nobject before init_state(), take the mode callback module reference there.\nAvoid taking it again from __iptfs_init_state() for the same object."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local XFRM SA migration via netlink XFRM_MSG_MIGRATE or PF_KEY SADB_X_MIGRATE, not by processing remote network packets alone.\nAC:L - On systems with IPTFS and XFRM_MIGRATE enabled, an attacker who controls the migrate request can reliably queue skbs on the SA and force a post-clone migration failure to trigger the shared-queue teardown.\nPR:L - All XFRM migrate operations require CAP_NET_ADMIN on the target network namespace, which unprivileged users can obtain inside a user namespace via unshare.\nUI:N - Exploitation requires no victim interaction beyond the attacker\u2019s own netlink/PF_KEY operations and traffic through an SA they control.\nS:U - Impact is kernel memory corruption and privilege escalation within the same kernel security authority, not a cross-VM or cross-IOMMU boundary escape.\nC:H - The bug is a use-after-free on sk_buff objects where the clone\u2019s destroy path frees skbs still owned by the live original IPTFS queue, enabling arbitrary kernel memory read primitives.\nI:H - Shared queue/timer state corruption and skb double-free provide exploitable heap corruption that can be leveraged for arbitrary kernel writes or code execution.\nA:H - The vulnerability causes kernel oops/panic from UAF and double-free in skb release paths, and can be used for repeatable denial of service against the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:05.089Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9327252e04626d4bb02ca8c0c108fbe8eabf0c5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/dfb9f6cbfa9826655a49698cf90eb800fce2178e"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f83d174073234839aea176f265e517e0d50a1d2"
        }
      ],
      "title": "xfrm: iptfs: reset runtime state when cloning SAs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63911",
    "datePublished": "2026-07-19T14:55:16.496Z",
    "dateReserved": "2026-07-19T07:54:57.020Z",
    "dateUpdated": "2026-08-05T12:37:05.089Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63911",
      "date": "2026-09-15",
      "epss": "0.00164",
      "percentile": "0.05946"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-63911\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:08.987\",\"lastModified\":\"2026-07-27T17:44:23.777\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxfrm: iptfs: reset runtime state when cloning SAs\\n\\niptfs_clone_state() clones the IPTFS mode data with kmemdup(). This\\ncopies runtime objects which must not be shared with the original SA,\\nincluding the embedded sk_buff_head, hrtimers, spinlock, and in-flight\\nreassembly/reorder state.\\n\\nIf xfrm_state_migrate() fails after clone_state() but before the later\\ninit_state() call has reinitialized those fields, the cloned state can be\\ndestroyed by xfrm_state_gc_task() with list and timer state copied from the\\noriginal SA. With queued packets this lets the clone splice and free skbs\\nowned by the original IPTFS queue, leading to use-after-free and\\ndouble-free reports in iptfs_destroy_state() and skb release paths.\\n\\nReinitialize the clone\u0027s runtime state before publishing it through\\nx-\u003emode_data. Because clone_state() now publishes a destroyable mode_data\\nobject before init_state(), take the mode callback module reference there.\\nAvoid taking it again from __iptfs_init_state() for the same object.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/xfrm/xfrm_iptfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0e4fbf013fa566f274ce9b4ce698c75b1f998c52\",\"lessThan\":\"9327252e04626d4bb02ca8c0c108fbe8eabf0c5a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0e4fbf013fa566f274ce9b4ce698c75b1f998c52\",\"lessThan\":\"dfb9f6cbfa9826655a49698cf90eb800fce2178e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0e4fbf013fa566f274ce9b4ce698c75b1f998c52\",\"lessThan\":\"7f83d174073234839aea176f265e517e0d50a1d2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/xfrm/xfrm_iptfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.35\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.12\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7f83d174073234839aea176f265e517e0d50a1d2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9327252e04626d4bb02ca8c0c108fbe8eabf0c5a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dfb9f6cbfa9826655a49698cf90eb800fce2178e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-21T21:13:46+00:00",
      "cve": "CVE-2026-63911",
      "id": "CVE-2026-63911",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xfrm: iptfs: reset runtime state when cloning SAs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63911.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-28T23:38:10Z",
      "cve": "CVE-2026-63911",
      "id": "CVE-2026-63911",
      "initial_release_date": "2026-07-21T13:03:44Z",
      "product_status:known_not_affected": "298",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63911",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63911.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.