CVE-2026-63911: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63911 Overview

CVE-2026-63911 is a use-after-free vulnerability in the Linux kernel's xfrm IPsec subsystem, specifically in the IP-TFS (Aggregation and Fragmentation Mode for IPsec) implementation. The flaw resides in iptfs_clone_state(), which uses kmemdup() to duplicate IPTFS mode data during Security Association (SA) migration. The duplication incorrectly shares runtime objects, including an embedded sk_buff_head, hrtimers, spinlock, and in-flight reassembly and reorder state, between the original and cloned SAs. A failure path in xfrm_state_migrate() can trigger destruction of the clone while it still references queued packets owned by the original SA queue.

Critical Impact
A local attacker with the ability to trigger SA migration failures can achieve use-after-free and double-free conditions in kernel memory, enabling privilege escalation or denial of service.

Affected Products

Linux kernel builds containing the xfrm IPTFS mode implementation
Distributions shipping kernels prior to the fix commits 7f83d17, 9327252, and dfb9f6c
Systems using IPsec IP-TFS with SA migration enabled

Discovery Timeline

2026-07-19 - CVE-2026-63911 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63911

Vulnerability Analysis

The vulnerability originates in the xfrm IPTFS mode cloning logic invoked during SA migration. When iptfs_clone_state() executes, it performs a shallow copy of the IPTFS mode data using kmemdup(). This copy includes live runtime structures that must remain uniquely owned: the sk_buff_head queue tracking pending skbs, hrtimers scheduling send and reassembly operations, a spinlock protecting queue access, and reassembly and reorder state for in-flight packets.

If xfrm_state_migrate() fails after clone_state() completes but before init_state() reinitializes those fields, the partially initialized clone is handed to xfrm_state_gc_task() for garbage collection. The garbage collector then invokes iptfs_destroy_state() on a structure whose lists and timer state still point to buffers owned by the original SA. Destruction unlinks and frees skbs the original SA continues to reference, producing use-after-free and double-free conditions in subsequent skb release paths.

Root Cause

The root cause is unsafe reuse of pointer and container state produced by kmemdup(). The clone inherits list heads, timer entries, and lock state that must not alias the source SA. The original code path deferred reinitialization of these fields to init_state(), creating a window where a destroyable object was reachable through x->mode_data while still sharing runtime state with the source.

Attack Vector

Exploitation requires local access with the ability to configure IPsec SAs and induce migration failures. Because the vulnerable object is exposed via x->mode_data before proper initialization, an attacker who can influence the timing or outcome of xfrm_state_migrate() can force the garbage collector to operate on the malformed clone. The resulting freed skbs remain reachable from the original SA queue, producing exploitable memory corruption in kernel context.

The upstream fix reinitializes the clone's runtime state before publishing it through x->mode_data and moves the mode callback module reference acquisition into clone_state(), removing the duplicate reference from __iptfs_init_state() for the same object. Refer to the Kernel Commit 7f83d17, Kernel Commit 9327252, and Kernel Commit dfb9f6c for the exact source changes.

Detection Methods for CVE-2026-63911

Indicators of Compromise

Kernel crash logs referencing iptfs_destroy_state(), skb_release_data(), or kfree_skb() with KASAN use-after-free or double-free reports.
Unexpected xfrm_state_gc_task invocations coinciding with failed xfrm_state_migrate() return codes in kernel traces.
Slab corruption warnings on SLUB or SLAB allocators immediately following IPsec SA migration events.

Detection Strategies

Enable KASAN and slub_debug on non-production hosts to surface the exact use-after-free signature described in the fix commit.
Audit systems for use of IPsec IP-TFS mode with SA migration by inspecting ip xfrm state output for iptfs mode entries.
Correlate kernel oops or panic events with preceding netlink messages issuing XFRM_MSG_MIGRATE operations.

Monitoring Recommendations

Ship kernel ring buffer output (dmesg, journald) to a central log store and alert on BUG:, KASAN, or general protection fault entries referencing xfrm or iptfs symbols.
Track process privilege changes and namespace creation events that could precede local exploitation attempts against the xfrm subsystem.
Monitor for unexpected reboots or kernel panics on hosts running strongSwan, libreswan, or other IPsec daemons that exercise IP-TFS.

How to Mitigate CVE-2026-63911

Immediate Actions Required

Apply the upstream stable kernel updates that include commits 7f83d17, 9327252, and dfb9f6c, or the equivalent distribution package updates.
Inventory hosts using IPsec IP-TFS and prioritize patching those that permit unprivileged namespace creation or expose SA management to non-root users.
Restrict CAP_NET_ADMIN to trusted service accounts to reduce the population of users able to trigger SA migration.

Patch Information

The fix reinitializes runtime state in the cloned IPTFS mode data before it becomes reachable through x->mode_data, and relocates the mode callback module reference acquisition into clone_state(). The patch removes the duplicate reference from __iptfs_init_state() for the same object. Backports are available for supported stable branches through the linked git.kernel.org commits.

Workarounds

Disable IPsec IP-TFS mode where operationally feasible by removing iptfs from ip xfrm state configurations until patched kernels are deployed.
Block or restrict user namespace creation via sysctl kernel.unprivileged_userns_clone=0 on distributions that honor it, limiting local attacker reach into xfrm APIs.
Deploy seccomp or LSM policies that deny AF_NETLINK sockets with the NETLINK_XFRM family to workloads that do not require IPsec management.

bash

# Verify the running kernel does not expose the vulnerable IPTFS clone path
uname -r
ip -s xfrm state | grep -i iptfs

# Temporary hardening: restrict unprivileged user namespaces
sysctl -w kernel.unprivileged_userns_clone=0

# Apply distribution kernel update (example: Debian/Ubuntu)
apt-get update && apt-get install --only-upgrade linux-image-$(uname -r)