CVE-2026-68420

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: reject optional IPTFS templates in outbound policies

syzbot reported a stack-out-of-bounds read in xfrm_state_find()

which flows from xfrm_tmpl_resolve_one().

Commit 3d776e31c841 ("xfrm: Reject optional tunnel/BEET mode

templates in outbound policies") disallowed optional tunnel and

BEET in outbound policies to prevent this. Later when IPTFS

added, it was not covered by that fix and can still trigger

the out-of-bounds read;

Extend the check to disallow optional IPTFS in outbound policies

as well. IPTFS should be identical to tunnel mode.

IN and FWD policies are not affected: xfrm_tmpl_resolve_one()

is only reachable via the outbound path.

Reproducer, before:

ip link add dummy0 type dummy

ip link set dummy0 up

ip addr add 10.1.1.1/24 dev dummy0

ip xfrm policy add src 10.1.1.1/32 dst 10.1.1.2/32 dir out tmpl

src fc00::dead:1 dst fc00::dead:2 proto esp reqid 1 mode iptfs

level use tmpl src fc00::dead:1 dst

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References