CVE-2026-68415

CVE-2026-68415 affects the Linux kernel xfrm subsystem, specifically when IPTFS mode setup fails. The root cause is that xfrm_state_gc_task can run long after a failed IPTFS state setup because x->mode_cbs remains cached in __xfrm_init_state() and is not cleared when mode initialization or clo...

CVE-2026-63911

CVE-2026-63911 (Linux kernel xfrm/iptfs) : The vulnerability arises in how IPTFS mode data is cloned during SA cloning. iptfs_clone_state() duplicates runtime objects (e.g., sk_buff_head, hrtimers, spinlocks, reassembly/reorder state) via kmemdup, which must not be shared with the original SA. If...