CVE-2026-68420: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68420 Overview

CVE-2026-68420 is a stack out-of-bounds read vulnerability in the Linux kernel's xfrm (IPsec transformation) subsystem. The flaw resides in xfrm_state_find(), reached through xfrm_tmpl_resolve_one(), and is triggered when an outbound IPsec policy contains an optional IP Traffic Flow Security (IPTFS) template. A prior fix (commit 3d776e31c841) rejected optional tunnel and BEET-mode templates in outbound policies, but IPTFS was not included in that check. Local users with permission to configure IPsec policies can trigger the out-of-bounds read, causing kernel memory disclosure or a denial of service.

Critical Impact
Local users capable of installing IPsec policies can trigger a kernel stack out-of-bounds read in __xfrm6_addr_hash(), leading to information disclosure or kernel panic.

Affected Products

Linux kernel branches that include IPTFS support in the xfrm subsystem
Distributions shipping the affected mainline kernel prior to the patch commits
Systems using IPsec with outbound policies containing optional templates

Discovery Timeline

2026-08-10 - CVE-2026-68420 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68420

Vulnerability Analysis

The vulnerability affects the Linux kernel's xfrm framework, which implements IPsec transformations. When resolving an outbound policy, xfrm_tmpl_resolve_one() iterates the policy's templates and calls xfrm_state_find() to locate a matching state. For optional templates in tunnel-like modes, the template addresses may be zero or unset, causing __xfrm_dst_hash() and downstream __xfrm6_addr_hash() to read past the intended stack buffer.

A prior commit (3d776e31c841) rejected optional tunnel and BEET templates in outbound policies for exactly this reason. IPTFS, added later, was not covered by that check. The syzbot fuzzer reported a KASAN stack-out-of-bounds read of 4 bytes in __xfrm6_addr_hash+0x11e/0x170 when an outbound policy contained an optional IPTFS template followed by a transport template.

Inbound (IN) and forward (FWD) policies are unaffected, as xfrm_tmpl_resolve_one() is reachable only via the outbound path.

Root Cause

The root cause is missing validation in the outbound template acceptance logic. IPTFS mode, which behaves identically to tunnel mode for the purposes of address resolution, was omitted from the list of modes rejected as optional in outbound policies. This allows a malformed template to reach xfrm_state_find() with uninitialized address fields.

Attack Vector

Exploitation requires local privileges sufficient to configure IPsec policies, typically CAP_NET_ADMIN within a user namespace or root. An attacker installs an outbound xfrm policy with an optional IPTFS template using ip xfrm policy add ... dir out tmpl ... mode iptfs level use ..., then sends any packet that matches the policy (for example, an ICMP echo). The subsequent lookup dereferences uninitialized stack memory in __xfrm6_addr_hash().

The reproducer in the advisory installs a dummy interface, adds an outbound IPsec policy chaining an optional IPTFS template with a transport template, and issues a ping. This triggers the KASAN report and can be leveraged for information disclosure or kernel instability.

Detection Methods for CVE-2026-68420

Indicators of Compromise

Kernel log entries containing BUG: KASAN: stack-out-of-bounds in __xfrm6_addr_hash or references to xfrm_state_find and xfrm_tmpl_resolve_one
Unexpected kernel oops or panic messages coincident with IPsec traffic on hosts using outbound xfrm policies
Presence of outbound xfrm policies containing templates with mode iptfs and level use

Detection Strategies

Audit installed IPsec policies with ip xfrm policy show and flag outbound policies that include optional (level use) IPTFS templates
Monitor dmesg and journald for KASAN reports or general protection faults originating in net/xfrm/
Track process invocations of ip xfrm policy add and setkey on production systems, correlating with unprivileged user namespaces

Monitoring Recommendations

Forward kernel logs to a central collector and alert on stack traces referencing xfrm_state_find or __xfrm6_addr_hash
Baseline which hosts legitimately use IPsec and treat new xfrm policy additions on other hosts as suspicious
Enable auditd rules on the setsockopt and netlink xfrm interfaces to record policy modifications

How to Mitigate CVE-2026-68420

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 9333f4b, d7fc6f3, and ea528f1 from your distribution vendor
Restrict CAP_NET_ADMIN and disable unprivileged user namespaces where they are not required for workload functionality
Inventory hosts using IPsec and remove any outbound policies containing optional IPTFS templates until patched

Patch Information

Upstream fixes extend the existing rejection of optional tunnel and BEET templates in outbound policies to also cover IPTFS mode. See the Kernel Git Commit 9333f4b, Kernel Git Commit d7fc6f3, and Kernel Git Commit ea528f1 for the exact code changes.

Workarounds

Disable IPTFS in kernel configuration where it is not required by rebuilding without CONFIG_XFRM_IPTFS
Prohibit outbound xfrm templates using level use with mode iptfs via configuration management and change control
Set kernel.unprivileged_userns_clone=0 (or the equivalent sysctl on your distribution) to prevent unprivileged users from obtaining CAP_NET_ADMIN in a user namespace

bash

# Configuration example: restrict unprivileged user namespaces and audit xfrm changes
sysctl -w kernel.unprivileged_userns_clone=0
auditctl -w /sbin/ip -p x -k xfrm_policy_change
ip xfrm policy show | grep -E 'mode iptfs|level use'