FKIE_CVE-2026-68420
Vulnerability from fkie_nvd - Published: 2026-08-10 13:20 - Updated: 2026-08-17 06:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: reject optional IPTFS templates in outbound policies
syzbot reported a stack-out-of-bounds read in xfrm_state_find()
which flows from xfrm_tmpl_resolve_one().
Commit 3d776e31c841 ("xfrm: Reject optional tunnel/BEET mode
templates in outbound policies") disallowed optional tunnel and
BEET in outbound policies to prevent this. Later when IPTFS
added, it was not covered by that fix and can still trigger
the out-of-bounds read;
Extend the check to disallow optional IPTFS in outbound policies
as well. IPTFS should be identical to tunnel mode.
IN and FWD policies are not affected: xfrm_tmpl_resolve_one()
is only reachable via the outbound path.
Reproducer, before:
ip link add dummy0 type dummy
ip link set dummy0 up
ip addr add 10.1.1.1/24 dev dummy0
ip xfrm policy add src 10.1.1.1/32 dst 10.1.1.2/32 dir out tmpl
src fc00::dead:1 dst fc00::dead:2 proto esp reqid 1 mode iptfs
level use tmpl src fc00::dead:1 dst fc00::dead:2 proto esp reqid
2 mode transport
ping -W 1 -c 1 10.1.1.2
PING 10.1.1.2 (10.1.1.2) 56(84) bytes of data.
[ 64.168420] ==================================================================
[ 64.169977] BUG: KASAN: stack-out-of-bounds in __xfrm6_addr_hash+0x11e/0x170
[ 64.169977] Read of size 4 at addr ffff88800e1ffd20 by task ping/2844
[ 64.169977] CPU: 2 UID: 0 PID: 2844 Comm: ping Not tainted 7.1.0-rc7-00180-geb23b588430a #98 PREEMPT(full)
[ 64.169977] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 64.169977] Call Trace:
[ 64.169977] <TASK>
[ 64.169977] dump_stack_lvl+0x47/0x70
[ 64.169977] ? __xfrm6_addr_hash+0x11e/0x170
[ 64.169977] print_report+0x152/0x4b0
[ 64.169977] ? ksys_mmap_pgoff+0x6d/0xa0
[ 64.169977] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 64.169977] ? rcu_read_unlock_sched+0xa/0x20
[ 64.169977] ? __virt_addr_valid+0x21b/0x230
[ 64.169977] ? __xfrm6_addr_hash+0x11e/0x170
[ 64.169977] kasan_report+0xa8/0xd0
[ 64.169977] ? __xfrm6_addr_hash+0x11e/0x170
[ 64.169977] __xfrm6_addr_hash+0x11e/0x170
[ 64.169977] __xfrm_dst_hash+0x24/0xc0
[ 64.169977] xfrm_state_find+0xa2d/0x2f90
[ 64.169977] ? __pfx_xfrm_state_find+0x10/0x10
[ 64.169977] ? __pfx_ftrace_graph_ret_addr+0x10/0x10
[ 64.169977] ? __pfx_ftrace_graph_ret_addr+0x10/0x10
[ 64.169977] xfrm_tmpl_resolve_one+0x210/0x570
[ 64.169977] ? __pfx_xfrm_tmpl_resolve_one+0x10/0x10
[ 64.169977] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 64.169977] ? kernel_text_address+0x5b/0x80
[ 64.169977] ? __kernel_text_address+0xe/0x30
[ 64.169977] ? unwind_get_return_address+0x5e/0x90
[ 64.169977] ? arch_stack_walk+0x8c/0xe0
[ 64.169977] xfrm_tmpl_resolve+0x130/0x200
[ 64.169977] ? __pfx_xfrm_tmpl_resolve+0x10/0x10
[ 64.169977] ? __pfx_xfrm_policy_inexact_lookup_rcu+0x10/0x10
[ 64.169977] ? __refcount_add_not_zero.constprop.0+0xb2/0x110
[ 64.169977] ? __pfx___refcount_add_not_zero.constprop.0+0x10/0x10
[ 64.169977] xfrm_resolve_and_create_bundle+0xd5/0x310
[ 64.169977] ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10
[ 64.169977] ? __pfx_xfrm_policy_lookup_bytype+0x10/0x10
[ 64.169977] ? __pfx_xfrm_policy_lookup_bytype+0x10/0x10
[ 64.169977] xfrm_lookup_with_ifid+0x3d8/0xb80
[ 64.169977] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10
[ 64.169977] ? ip_route_output_key_hash+0xc6/0x110
[ 64.169977] ? kasan_save_track+0x10/0x30
[ 64.169977] xfrm_lookup_route+0x18/0xe0
[ 64.169977] ip4_datagram_release_cb+0x4c9/0x530
[ 64.169977] ? __pfx_ip4_datagram_release_cb+0x10/0x10
[ 64.169977] ? do_raw_spin_lock+0x71/0xc0
[ 64.169977] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 64.169977] release_sock+0xb0/0x170
[ 64.169977] udp_connect+0x43/0x50
[ 64.169977] __sys_connect+0xa6/0x100
[ 64.169977] ? alloc_fd+0x2e9/0x300
[ 64.169977] ? __pfx___sys_connect+0x10/0x10
[ 64.169977] ? preempt_latency
---truncated---
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_user.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d7fc6f351c478586980a521d63b0214d9c055e78",
"status": "affected",
"version": "d1716d5a44c37e5743bf6ea4e5cdbdab37727f27",
"versionType": "git"
},
{
"lessThan": "9333f4b6f44858fc98eb12bf26b8d2959eb975d5",
"status": "affected",
"version": "d1716d5a44c37e5743bf6ea4e5cdbdab37727f27",
"versionType": "git"
},
{
"lessThan": "ea528f18231ec0f33317be57f8866913b19aba6e",
"status": "affected",
"version": "d1716d5a44c37e5743bf6ea4e5cdbdab37727f27",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_user.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: reject optional IPTFS templates in outbound policies\n\nsyzbot reported a stack-out-of-bounds read in xfrm_state_find()\nwhich flows from xfrm_tmpl_resolve_one().\n\nCommit 3d776e31c841 (\"xfrm: Reject optional tunnel/BEET mode\ntemplates in outbound policies\") disallowed optional tunnel and\nBEET in outbound policies to prevent this. Later when IPTFS\nadded, it was not covered by that fix and can still trigger\nthe out-of-bounds read;\n\nExtend the check to disallow optional IPTFS in outbound policies\nas well. IPTFS should be identical to tunnel mode.\nIN and FWD policies are not affected: xfrm_tmpl_resolve_one()\nis only reachable via the outbound path.\n\nReproducer, before:\n\nip link add dummy0 type dummy\nip link set dummy0 up\nip addr add 10.1.1.1/24 dev dummy0\nip xfrm policy add src 10.1.1.1/32 dst 10.1.1.2/32 dir out tmpl\n src fc00::dead:1 dst fc00::dead:2 proto esp reqid 1 mode iptfs\n level use tmpl src fc00::dead:1 dst fc00::dead:2 proto esp reqid\n 2 mode transport\nping -W 1 -c 1 10.1.1.2\nPING 10.1.1.2 (10.1.1.2) 56(84) bytes of data.\n\n[ 64.168420] ==================================================================\n[ 64.169977] BUG: KASAN: stack-out-of-bounds in __xfrm6_addr_hash+0x11e/0x170\n[ 64.169977] Read of size 4 at addr ffff88800e1ffd20 by task ping/2844\n\n[ 64.169977] CPU: 2 UID: 0 PID: 2844 Comm: ping Not tainted 7.1.0-rc7-00180-geb23b588430a #98 PREEMPT(full)\n[ 64.169977] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 64.169977] Call Trace:\n[ 64.169977] \u003cTASK\u003e\n[ 64.169977] dump_stack_lvl+0x47/0x70\n[ 64.169977] ? __xfrm6_addr_hash+0x11e/0x170\n[ 64.169977] print_report+0x152/0x4b0\n[ 64.169977] ? ksys_mmap_pgoff+0x6d/0xa0\n[ 64.169977] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 64.169977] ? rcu_read_unlock_sched+0xa/0x20\n[ 64.169977] ? __virt_addr_valid+0x21b/0x230\n[ 64.169977] ? __xfrm6_addr_hash+0x11e/0x170\n[ 64.169977] kasan_report+0xa8/0xd0\n[ 64.169977] ? __xfrm6_addr_hash+0x11e/0x170\n[ 64.169977] __xfrm6_addr_hash+0x11e/0x170\n[ 64.169977] __xfrm_dst_hash+0x24/0xc0\n[ 64.169977] xfrm_state_find+0xa2d/0x2f90\n[ 64.169977] ? __pfx_xfrm_state_find+0x10/0x10\n[ 64.169977] ? __pfx_ftrace_graph_ret_addr+0x10/0x10\n[ 64.169977] ? __pfx_ftrace_graph_ret_addr+0x10/0x10\n[ 64.169977] xfrm_tmpl_resolve_one+0x210/0x570\n[ 64.169977] ? __pfx_xfrm_tmpl_resolve_one+0x10/0x10\n[ 64.169977] ? __pfx_stack_trace_consume_entry+0x10/0x10\n[ 64.169977] ? kernel_text_address+0x5b/0x80\n[ 64.169977] ? __kernel_text_address+0xe/0x30\n[ 64.169977] ? unwind_get_return_address+0x5e/0x90\n[ 64.169977] ? arch_stack_walk+0x8c/0xe0\n[ 64.169977] xfrm_tmpl_resolve+0x130/0x200\n[ 64.169977] ? __pfx_xfrm_tmpl_resolve+0x10/0x10\n[ 64.169977] ? __pfx_xfrm_policy_inexact_lookup_rcu+0x10/0x10\n[ 64.169977] ? __refcount_add_not_zero.constprop.0+0xb2/0x110\n[ 64.169977] ? __pfx___refcount_add_not_zero.constprop.0+0x10/0x10\n[ 64.169977] xfrm_resolve_and_create_bundle+0xd5/0x310\n[ 64.169977] ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10\n[ 64.169977] ? __pfx_xfrm_policy_lookup_bytype+0x10/0x10\n[ 64.169977] ? __pfx_xfrm_policy_lookup_bytype+0x10/0x10\n[ 64.169977] xfrm_lookup_with_ifid+0x3d8/0xb80\n[ 64.169977] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10\n[ 64.169977] ? ip_route_output_key_hash+0xc6/0x110\n[ 64.169977] ? kasan_save_track+0x10/0x30\n[ 64.169977] xfrm_lookup_route+0x18/0xe0\n[ 64.169977] ip4_datagram_release_cb+0x4c9/0x530\n[ 64.169977] ? __pfx_ip4_datagram_release_cb+0x10/0x10\n[ 64.169977] ? do_raw_spin_lock+0x71/0xc0\n[ 64.169977] ? __pfx_do_raw_spin_lock+0x10/0x10\n[ 64.169977] release_sock+0xb0/0x170\n[ 64.169977] udp_connect+0x43/0x50\n[ 64.169977] __sys_connect+0xa6/0x100\n[ 64.169977] ? alloc_fd+0x2e9/0x300\n[ 64.169977] ? __pfx___sys_connect+0x10/0x10\n[ 64.169977] ? preempt_latency\n---truncated---"
}
],
"id": "CVE-2026-68420",
"lastModified": "2026-08-17T06:17:51.013",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-08-10T13:20:35.840",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/9333f4b6f44858fc98eb12bf26b8d2959eb975d5"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/d7fc6f351c478586980a521d63b0214d9c055e78"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/ea528f18231ec0f33317be57f8866913b19aba6e"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…