CVE-2026-68426

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: fix stale skb->prev after async crypto steals a GSO segment

skb_gso_segment() leaves the segment list head with ->prev pointing at

the last segment, an invariant validate_xmit_skb_list() relies on when

it sets its tail pointer (tail = skb->prev).

When validate_xmit_xfrm() walks a GSO list and some segments are stolen

by async crypto (->xmit() returns -EINPROGRESS), those segments are

unlinked from the list but the head ->prev is never updated. If the

last segment is the one stolen, the returned head still has ->prev

pointing at it, even though it is now owned by the crypto engine and may

be freed. validate_xmit_skb_list() later does tail->next = skb, writing

through that stale pointer -- a use-after-free.

Repoint skb->prev at the last retained segment before returning.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References