CVE-2026-68426

Status: UPDATED  |  Advisory ID: CVE-2026-68426

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

xfrm: fix stale skb->prev after async crypto steals a GSO segment

skb_gso_segment() leaves the segment list head with ->prev pointing at

the last segment, an invariant validate_xmit_skb_list() relies on when

it sets its tail pointer (tail = skb->prev).

When validate_xmit_xfrm() walks a GSO list and some segments are stolen

by async crypto (->xmit() returns -EINPROGRESS), those segments are

unlinked from the list but the head ->prev is never updated. If the

last segment is the one stolen, the returned head still has ->prev

pointing at it, even though it is now owned by the crypto engine and may

be freed. validate_xmit_skb_list() later does tail->next = skb, writing

through that stale pointer -- a use-after-free.

Repoint skb->prev at the last retained segment before returning. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References