CVE-2026-68426: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-68426 is a use-after-free vulnerability in the Linux kernel's xfrm (IPsec) subsystem, specifically in GSO (Generic Segmentation Offload) segment handling when asynchronous crypto operations steal segments. When validate_xmit_xfrm() walks a GSO list and segments are stolen by async crypto (returning -EINPROGRESS), the segment list head's ->prev pointer is never updated, leaving it pointing to a freed segment that may be subsequently dereferenced. The vulnerability was published on August 10, 2026, and affects Linux kernel versions from 4.16 onward, with fixes available in 6.18.42, 7.1.6, and 7.2-rc4. Feedly estimates the severity as HIGH, though an official CVSS score has not yet been assigned (GitHub Advisory, Feedly).

The root cause is a stale pointer condition (CWE class: Use After Free) in the Linux kernel's validate_xmit_xfrm() function. skb_gso_segment() leaves the GSO segment list head with ->prev pointing at the last segment — an invariant that validate_xmit_skb_list() relies upon when setting its tail pointer (tail = skb->prev). When async crypto steals one or more segments (its ->xmit() returns -EINPROGRESS), those segments are unlinked from the list but skb->prev on the head is never updated. If the stolen segment was the last one, validate_xmit_skb_list() later executes tail->next = skb, writing through the now-stale pointer into memory owned by the crypto engine — constituting a use-after-free. The fix repoints skb->prev to the last retained segment before returning from validate_xmit_xfrm() (GitHub Advisory).

A local user with the ability to initiate network transmissions using GSO-enabled traffic through the xfrm/IPsec subsystem can trigger this use-after-free, potentially enabling arbitrary kernel memory reads or writes through the stale skb->prev pointer dereference. Successful exploitation could lead to kernel memory disclosure, privilege escalation, or system instability (kernel panic/crash), depending on the memory state at the time of exploitation. The impact is limited to local attackers with network transmission capability on systems using IPsec with async crypto offload (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is 0.0, reflecting the current absence of exploitation activity. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to send GSO-segmented traffic through an xfrm/IPsec policy backed by an async crypto accelerator, which limits the practical attack surface.

Apply the available kernel patches: the fix is included in Linux kernel versions 6.18.42, 7.1.6, and 7.2-rc4, corresponding to upstream commits 33e1b0d25ca0, bbca7cc3b2b4, and 3f4c3919baf0 (GitHub Advisory). Administrators should update to a patched kernel version as the primary remediation. As a temporary workaround where patching is not immediately possible, disabling async crypto offload for xfrm/IPsec policies (if operationally feasible) would prevent the vulnerable code path from being triggered.