CVE-2026-68415

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: clear mode callbacks after failed mode setup

xfrm_state_gc_task can run long after a failed IPTFS state setup. In the

reproduced case, __xfrm_init_state() cached x->mode_cbs, IPTFS setup

returned -ENOMEM before publishing mode_data, and the temporary module

reference from xfrm_get_mode_cbs() was dropped immediately. The dead state

then kept x->mode_cbs until deferred GC ran after xfrm_iptfs had been

unloaded.

Clear x->mode_cbs when mode init or clone fails before publishing

mode_data. Those states never installed mode-specific state or the

long-term IPTFS module pin, so deferred GC has nothing mode-specific to

destroy and must not retain a callback table pointer past the temporary

lookup reference.

The buggy scenario involves two paths, with each column showing the order

within that path:

failed setup path:

1. cache x->mode_cbs

2. mode setup fails before mode_data

3. drop the temporary module ref

4. dead sta

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References