CVE-2026-68415 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
xfrm: clear mode callbacks after failed mode setup
xfrm_state_gc_task can run long after a failed IPTFS state setup. In the reproduced case, __xfrm_init_state() cached x->mode_cbs, IPTFS setup returned -ENOMEM before publishing mode_data, and the temporary module reference from xfrm_get_mode_cbs() was dropped immediately. The dead state then kept x->mode_cbs until deferred GC ran after xfrm_iptfs had been unloaded.
Clear x->mode_cbs when mode init or clone fails before publishing mode_data. Those states never installed mode-specific state or the long-term IPTFS module pin, so deferred GC has nothing mode-specific to destroy and must not retain a callback table pointer past the temporary lookup reference.
The buggy scenario involves two paths, with each column showing the order within that path:
failed setup path: 1. cache x->mode_cbs 2. mode setup fails before mode_data 3. drop the temporary module ref 4. dead state keeps x->mode_cbs cached
GC/unload path: 1. xfrm_state_put() queues GC work 2. xfrm_iptfs unloads later 3. xfrm_state_gc_task runs 4. GC dereferences stale x->mode_cbs
This also covers the failed clone path where clone_state() returns before publishing mode_data.
Validation reproduced this kernel report: Kernel panic - not syncing: Fatal exception CONFIG_FAULT_INJECTION_STACKTRACE_FILTER=y failslab_stacktrace_filter matched xfrm_iptfs frames ack_error=-12 FAULT_INJECTION: forcing a failure BUG: unable to handle page fault Workqueue: events xfrm_state_gc_task RIP: xfrm_state_gc_task+0x142/0x650 Modules linked in: esp4_offload xfrm_user [last unloaded: xfrm_iptfs]
Kernel panic - not syncing: Fatal exception
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability described represents a critical memory management issue within the Linux kernel's IPsec framework, specifically affecting the eXtensible Frame Routing (xfrm) subsystem. This flaw manifests when handling failed IPTFS (IPsec Tunneling Framework) state setups where the kernel fails to properly clean up mode callback references after initialization failures. The root cause lies in the improper handling of x->mode_cbs pointers during asynchronous operations, creating a scenario where stale callback references persist beyond their valid lifetime.
The technical flaw stems from a race condition between the initialization path and garbage collection mechanisms within the xfrm subsystem. When __xfrm_init_state() caches x->mode_cbs during setup, subsequent failures in mode initialization before mode_data publication leave these cached callbacks unreleased. The temporary module reference obtained through xfrm_get_mode_cbs() is dropped immediately upon failure, but the cached mode_cbs pointer remains accessible to deferred garbage collection routines. This creates a dangling pointer scenario that directly violates the principle of proper resource cleanup and memory management practices.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially cause kernel panics and system crashes. The described scenario demonstrates how xfrm_state_gc_task can execute long after failed IPTFS state setup, attempting to dereference stale mode_cbs pointers that point to unloaded module code segments. This condition directly maps to CWE-415: Double Free and CWE-416: Use After Free vulnerabilities, as the system attempts to access memory that has already been released or invalidated. The kernel panic output confirms this behavior with error messages indicating fatal exceptions during page fault handling when attempting to execute xfrm_state_gc_task on freed callback structures.
The attack surface for this vulnerability involves any system utilizing IPsec tunneling frameworks where xfrm state management operations may fail during initialization phases. Systems running with CONFIG_FAULT_INJECTION_STACKTRACE_FILTER enabled are particularly susceptible as they expose additional attack vectors through fault injection mechanisms that can trigger the exact conditions described in the bug report. The issue affects the broader ATT&CK matrix category of Privilege Escalation through Kernel Exploitation, as successful exploitation could allow attackers to cause system crashes or potentially gain elevated privileges through controlled kernel memory corruption.
Mitigation strategies must focus on implementing proper resource cleanup mechanisms at all failure points within the xfrm initialization pipeline. The solution requires clearing x->mode_cbs pointers immediately upon detection of mode init or clone failures before any mode_data publication occurs, ensuring that deferred garbage collection routines never encounter stale callback references. This approach aligns with standard kernel development practices for asynchronous operation handling and proper reference counting mechanisms. Additionally, implementing defensive programming techniques such as NULL pointer checks in garbage collection paths and enhanced module lifecycle management would prevent similar issues in other subsystems. The fix should be integrated into all affected kernel versions and patched distributions to ensure comprehensive protection against this class of memory corruption vulnerabilities.