Linux Kernel: UAF due to stale skb->prev in xfrm after async crypto
CVE-2026-68426 Published on August 10, 2026
xfrm: fix stale skb->prev after async crypto steals a GSO segment
In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix stale skb->prev after async crypto steals a GSO segment
skb_gso_segment() leaves the segment list head with ->prev pointing at
the last segment, an invariant validate_xmit_skb_list() relies on when
it sets its tail pointer (tail = skb->prev).
When validate_xmit_xfrm() walks a GSO list and some segments are stolen
by async crypto (->xmit() returns -EINPROGRESS), those segments are
unlinked from the list but the head ->prev is never updated. If the
last segment is the one stolen, the returned head still has ->prev
pointing at it, even though it is now owned by the crypto engine and may
be freed. validate_xmit_skb_list() later does tail->next = skb, writing
through that stale pointer -- a use-after-free.
Repoint skb->prev at the last retained segment before returning.
Products Associated with CVE-2026-68426
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version f53c723902d1ac5f0b0a11d7c9dcbff748dde74e and below 33e1b0d25ca0d2818c635ff80e6aa0d295e08a98 is affected.
- Version f53c723902d1ac5f0b0a11d7c9dcbff748dde74e and below bbca7cc3b2b4b10afbfee99b81d9ee78f5423046 is affected.
- Version f53c723902d1ac5f0b0a11d7c9dcbff748dde74e and below 3f4c3919baf0944ad96580467c302bc6c7758b00 is affected.
- Version 4.16 is affected.
- Before 4.16 is unaffected.
- Version 6.18.42, <= 6.18.* is unaffected.
- Version 7.1.6, <= 7.1.* is unaffected.
- Version 7.2-rc4, <= * is unaffected.