CVE-2026-63911

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: iptfs: reset runtime state when cloning SAs

iptfs_clone_state() clones the IPTFS mode data with kmemdup(). This

copies runtime objects which must not be shared with the original SA,

including the embedded sk_buff_head, hrtimers, spinlock, and in-flight

reassembly/reorder state.

If xfrm_state_migrate() fails after clone_state() but before the later

init_state() call has reinitialized those fields, the cloned state can be

destroyed by xfrm_state_gc_task() with list and timer state copied from the

original SA. With queued packets this lets the clone splice and free skbs

owned by the original IPTFS queue, leading to use-after-free and

double-free reports in iptfs_destroy_state() and skb release paths.

Reinitialize the clone's runtime state before publishing it through

x->mode_data. Because clone_state() now publishes a destroyable mode_data

object before init_state(), take the mode callback module reference there

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References