CVE-2026-68420

CVE-2026-68420 is a stack memory disclosure in the Linux kernel's XFRM subsystem, specifically an out-of-bounds read when resolving optional IPTFS templates in outbound policies. The read primitive exposes kernel stack memory, enabling ASLR bypass — this is the mechanism behind the CVSS 7.1 score. The EPSS of 0.00115 is deceptively reassuring, and understanding why requires examining the exploit chain, not just direct exploitation probability. The vulnerability is outbound-only: xfrm_tmpl_resolve_one() is only reachable from the outbound policy path, leaving IN and FWD directions unaffected. That's not a security guarantee — it's a call-graph snapshot that documents current architecture, not an invariant. Future routing refactors could silently introduce new call paths. Treat the 'outbound only' scope as provisional, not permanent. The deeper concern is that this is the third occurrence in the XFRM lineage — tunnel, BEET, now IPTFS. Each was a mode-specific exclusion added after the fact, rather than a principled policy against optional modes in outbound policies. The fix encodes 'forbid tunnel and BEET' rather than 'define what optional modes are permitted to do.' This pattern — deny-lists that decay with each feature addition — is structurally guaranteed to produce future regressions. Every new XFRM mode inherits this debt unless the subsystem adopts a formal threat-model review gate for mode additions. For defenders: patch immediately. The EPSS low probability likely reflects the privileged-configuration assumption — manipulating XFRM policies traditionally requires root. But kernel address disclosure doesn't need to achieve privilege escalation on its own. It feeds downstream attacks: unprivileged eBPF programs, container escapes, or subsequent kernel exploits that consume the leaked address. The CVSS 7.1 correctly models this as a force multiplier in an attack chain, not a standalone impact. Monitor for any XFRM policy manipulation from containers or unprivileged users in your environment — that's the execution path this CVE enables.

Reviewed through automated stages and approved by a human before publication.