CVE-2026-68415

CVE-2026-68415 is a use-after-free in the Linux kernel's XFRM subsystem affecting the IPTFS mode. The vulnerability stems from a temporal window in the state lifecycle: during __xfrm_init_state, a pointer to the mode's callback table (x->mode_cbs) is cached before the mode setup either succeeds or fails. If setup fails after this caching but before mode_data is published, the state object retains a stale pointer to memory owned by a module that has already unloaded. The kernel's GC task (xfrm_state_gc_task) then dereferences this pointer against unmapped memory, triggering a guaranteed kernel panic. The fix—clearing x->mode_cbs on failure—is correct for this instance but addresses a symptom, not the underlying architectural fragility. The core issue is that the XFRM state lifecycle has no enforced invariant tying mode_cbs validity to the state being 'live.' The architecture permits caching a pointer before the mode is guaranteed to be committed, and the GC path lacks any guard checking whether mode_data was ever initialized before dereferencing mode_cbs. The EPSS score (0.00134) is misleading. It measures exploitability, but this is a deterministic failure mode triggered by normal module lifecycle operations—not a sophisticated exploit. Any IPTFS state setup failure followed by module unload produces the panic. The practical severity is higher than the score suggests. What to check: verify that your kernels include the specific fix clearing x->mode_cbs in the failure path of __xfrm_init_state or equivalent mode setup. Beyond patching, examine whether other XFRM modes (not just IPTFS) exhibit similar callback patterns where pointers are cached before commitment. The broader question is whether the XFRM subsystem needs a state machine API that enforces which fields are valid at each initialization stage—making lifecycle errors impossible rather than merely possible to avoid.

Reviewed through automated stages and approved by a human before publication.