What is the CVSS score of CVE-2026-68420?

CVE-2026-68420 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-68420?

Within 24 hours, identify all Linux systems running vulnerable kernel versions and assess whether XFRM/IPsec policy configuration is active-prioritize cloud instances, network appliances, and security gateways. Within 7 days, obtain and test the vendor-released patch from your Linux distribution (Red Hat, Ubuntu, Debian, etc.) in a staging environment to validate compatibility with your XFRM policy configurations and confirm normal IPsec operation. Within 30 days, complete production deployment of patched kernels across all affected systems, prioritizing those with XFRM/IPsec actively in use.

Linux Kernel CVE-2026-68420

EUVD-2026-55606 HIGH

2026-08-10 Linux

GHSA-hf2r-xm53-x39m

Buffer Overflow Linux Debian

7.1

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain CAP_NET_ADMIN via unprivileged user namespace
Delivery

Configure outbound XFRM policy with optional IPTFS + transport templates
Exploit

Send outbound traffic matching policy selector
Execution

xfrm_tmpl_resolve_one() fails to reject optional IPTFS template
Persist

Stack OOB read in __xfrm6_addr_hash()
Impact

Leak kernel stack memory or trigger kernel panic

Vulnerability Assessment

Exploitation Conditions	Exploitation requires CAP_NET_ADMIN capability, which can be obtained either via local root access or through an unprivileged user namespace (available by default on Debian, Ubuntu, and many other distributions unless explicitly disabled via kernel.unprivileged_userns_clone=0). The specific triggering condition is an outbound XFRM policy configured with at least two templates where the first template uses IPTFS mode with level=use (optional) and the second uses transport mode - this exact configuration is required; a single-template policy or a mandatory IPTFS template does not trigger the bug. Outbound traffic matching the policy's source and destination selectors must then be generated to reach the vulnerable code path. Systems not using IPsec XFRM policies at all, or using only mandatory (not optional/level=use) IPTFS templates, are not exposed. Only outbound policies are affected; inbound (dir in) and forward (dir fwd) policies do not reach xfrm_tmpl_resolve_one() via this path.
Impact	The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H is consistent with the actual exploitation requirements: local access with CAP_NET_ADMIN is needed to configure XFRM policies, but on systems with unprivileged user namespaces enabled (the default on Debian and Ubuntu), this is reachable from low-privilege accounts. EPSS at 0.15% (5th percentile) reflects very low observed exploitation probability and the absence of a CISA KEV listing confirms no confirmed in-the-wild exploitation at time of analysis - these two signals align. Even a mid-sized municipal IT team in swidnica running containerized workloads on unpatched kernels should treat this as a meaningful risk if IPsec policies using IPTFS are in scope, since the embedded reproducer in the upstream commit provides a near-complete exploitation blueprint. The high confidentiality impact rating is consistent with the ability to read arbitrary kernel stack memory (which may contain cryptographic keys, pointers, or other sensitive data); the high availability impact reflects the potential for a kernel panic via out-of-bounds memory access. The attack requires a non-default but operationally legitimate XFRM configuration - systems not deploying IPsec with IPTFS mode are not exposed. Overall this is a targeted risk for IPsec-using Linux infrastructure, not a broad-exposure mass-exploitation priority.
Exploit ScenarioDerived	A local user with CAP_NET_ADMIN - obtained via an unprivileged user namespace on a default Debian or Ubuntu system - runs the reproducer embedded in the upstream commit: they add a dummy network interface, assign an address, then install an outbound XFRM policy with an optional IPTFS template (level=use) followed by a transport template, and trigger outbound traffic with ping. The kernel's xfrm_tmpl_resolve_one() processes the policy, passes the IPTFS template to xfrm_state_find(), which calls __xfrm6_addr_hash() on malformed data, reading 4 bytes beyond the valid stack region - leaking kernel stack contents or triggering a kernel panic. No additional exploit development is needed beyond the documented reproducer.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 14, 2026

Stack-out-of-bounds read in the Linux kernel's XFRM/IPsec subsystem allows a local user with network policy configuration privileges to read out-of-bounds kernel stack memory and potentially crash the system by crafting an outbound XFRM policy using an optional IPTFS-mode template. The flaw is an incomplete fix: commit 3d776e31c841 blocked optional tunnel and BEET templates in outbound policies to prevent this exact class of bug, but the later-added IPTFS mode was never covered by that restriction. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.15%, and a functional reproducer is embedded in the upstream fix commit, lowering the barrier for any local attacker who discovers the configuration.

RemediationAI

Upgrade to Linux kernel 7.1.6, 7.2-rc4, or 6.18.42 (or any later stable release), which contain the fix extending the outbound XFRM optional-template restriction to cover IPTFS mode. The three upstream backport commits are at https://git.kernel.org/stable/c/d7fc6f351c478586980a521d63b0214d9c055e78, https://git.kernel.org/stable/c/9333f4b6f44858fc98eb12bf26b8d2959eb975d5, and https://git.kernel.org/stable/c/ea528f18231ec0f33317be57f8866913b19aba6e. As a compensating control where immediate patching is not feasible, audit all outbound XFRM policies using ip xfrm policy show and remove or rewrite any policy that combines an IPTFS-mode template marked level use (optional) with a subsequent transport-mode template in the same outbound policy chain - changing level use to level required on IPTFS templates eliminates the vulnerable code path without removing IPsec protection. Restricting unprivileged user namespaces via sysctl -w kernel.unprivileged_userns_clone=0 (on supporting distributions) raises the privilege bar to system-level CAP_NET_ADMIN, reducing exposure surface; note this will break rootless container runtimes such as Podman and rootless Docker. No patch version for the Linux 6.14 stable branch was confirmed from the provided data - administrators on that branch should verify backport availability with their distribution vendor.

Affected VersionsENISA

Linux patch: 7.2-rc4

Linux d1716d5a44c37e5743bf6ea4e5cdbdab37727f27 <ea528f18231ec0f33317be57f8866913b19aba6e

Linux patch: 7.1.6

Linux 6.14

Linux patch: 0

Linux d1716d5a44c37e5743bf6ea4e5cdbdab37727f27 <9333f4b6f44858fc98eb12bf26b8d2959eb975d5

Linux d1716d5a44c37e5743bf6ea4e5cdbdab37727f27 <d7fc6f351c478586980a521d63b0214d9c055e78

Linux patch: 6.18.42

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in the Linux kernel's net/xfrm subsystem, which implements the IPsec framework for IP-layer encryption, authentication, and traffic-flow security. IPTFS (IP Traffic Flow Security, RFC 9347) was added to the kernel via commit d1716d5a44c3 and introduces a new template mode alongside tunnel, transport, and BEET. The vulnerable code path traverses xfrm_tmpl_resolve_one() → xfrm_state_find() → __xfrm_dst_hash() → __xfrm6_addr_hash(). When an outbound policy contains an optional (level=use) IPTFS template followed by a transport-mode template, xfrm_tmpl_resolve_one() does not correctly gate the IPTFS case as it does for tunnel and BEET, allowing xfrm_state_find() to call hash functions on malformed or boundary-crossing data, producing a KASAN-detected stack-out-of-bounds read of 4 bytes. The root cause is logically equivalent to CWE-125 (Out-of-bounds Read). The CPE affected string is cpe:2.3:a:linux:linux and only the outbound path (xfrm_resolve_and_create_bundle → xfrm_lookup_with_ifid) is reachable - IN and FWD policies do not trigger this path.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

vuln.today AI 7.1 HIGH

Requires CAP_NET_ADMIN to configure XFRM policies - achievable via user namespaces (PR:L); high C from kernel stack memory disclosure, high A from potential kernel panic; no integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE 5.5 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Aug 13, 2026 - 23:37 NVD

7.1 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 12:04 cve.org

HIGH 7.1

CVE Published

Aug 10, 2026 - 12:04 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xfrm: reject optional IPTFS templates in outbound policies

syzbot reported a stack-out-of-bounds read in xfrm_state_find() which flows from xfrm_tmpl_resolve_one().

Commit 3d776e31c841 ("xfrm: Reject optional tunnel/BEET mode templates in outbound policies") disallowed optional tunnel and BEET in outbound policies to prevent this. Later when IPTFS added, it was not covered by that fix and can still trigger the out-of-bounds read;

Extend the check to disallow optional IPTFS in outbound policies as well. IPTFS should be identical to tunnel mode. IN and FWD policies are not affected: xfrm_tmpl_resolve_one() is only reachable via the outbound path.

Reproducer, before:

ip link add dummy0 type dummy ip link set dummy0 up ip addr add 10.1.1.1/24 dev dummy0 ip xfrm policy add src 10.1.1.1/32 dst 10.1.1.2/32 dir out tmpl src fc00::dead:1 dst fc00::dead:2 proto esp reqid 1 mode iptfs level use tmpl src fc00::dead:1 dst fc00::dead:2 proto esp reqid 2 mode transport ping -W 1 -c 1 10.1.1.2 PING 10.1.1.2 (10.1.1.2) 56(84) bytes of data.

[ 64.168420] ============== [ 64.169977] BUG: KASAN: stack-out-of-bounds in __xfrm6_addr_hash+0x11e/0x170 [ 64.169977] Read of size 4 at addr ffff88800e1ffd20 by task ping/2844

[ 64.169977] CPU: 2 UID: 0 PID: 2844 Comm: ping Not tainted 7.1.0-rc7-00180-geb23b588430a #98 PREEMPT(full) [ 64.169977] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 64.169977] Call Trace: [ 64.169977] <TASK> [ 64.169977] dump_stack_lvl+0x47/0x70 [ 64.169977] ? __xfrm6_addr_hash+0x11e/0x170 [ 64.169977] print_report+0x152/0x4b0 [ 64.169977] ? ksys_mmap_pgoff+0x6d/0xa0 [ 64.169977] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 64.169977] ? rcu_read_unlock_sched+0xa/0x20 [ 64.169977] ? __virt_addr_valid+0x21b/0x230 [ 64.169977] ? __xfrm6_addr_hash+0x11e/0x170 [ 64.169977] kasan_report+0xa8/0xd0 [ 64.169977] ? __xfrm6_addr_hash+0x11e/0x170 [ 64.169977] __xfrm6_addr_hash+0x11e/0x170 [ 64.169977] __xfrm_dst_hash+0x24/0xc0 [ 64.169977] xfrm_state_find+0xa2d/0x2f90 [ 64.169977] ? __pfx_xfrm_state_find+0x10/0x10 [ 64.169977] ? __pfx_ftrace_graph_ret_addr+0x10/0x10 [ 64.169977] ? __pfx_ftrace_graph_ret_addr+0x10/0x10 [ 64.169977] xfrm_tmpl_resolve_one+0x210/0x570 [ 64.169977] ? __pfx_xfrm_tmpl_resolve_one+0x10/0x10 [ 64.169977] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 64.169977] ? kernel_text_address+0x5b/0x80 [ 64.169977] ? __kernel_text_address+0xe/0x30 [ 64.169977] ? unwind_get_return_address+0x5e/0x90 [ 64.169977] ? arch_stack_walk+0x8c/0xe0 [ 64.169977] xfrm_tmpl_resolve+0x130/0x200 [ 64.169977] ? __pfx_xfrm_tmpl_resolve+0x10/0x10 [ 64.169977] ? __pfx_xfrm_policy_inexact_lookup_rcu+0x10/0x10 [ 64.169977] ? __refcount_add_not_zero.constprop.0+0xb2/0x110 [ 64.169977] ? __pfx___refcount_add_not_zero.constprop.0+0x10/0x10 [ 64.169977] xfrm_resolve_and_create_bundle+0xd5/0x310 [ 64.169977] ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10 [ 64.169977] ? __pfx_xfrm_policy_lookup_bytype+0x10/0x10 [ 64.169977] ? __pfx_xfrm_policy_lookup_bytype+0x10/0x10 [ 64.169977] xfrm_lookup_with_ifid+0x3d8/0xb80 [ 64.169977] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 64.169977] ? ip_route_output_key_hash+0xc6/0x110 [ 64.169977] ? kasan_save_track+0x10/0x30 [ 64.169977] xfrm_lookup_route+0x18/0xe0 [ 64.169977] ip4_datagram_release_cb+0x4c9/0x530 [ 64.169977] ? __pfx_ip4_datagram_release_cb+0x10/0x10 [ 64.169977] ? do_raw_spin_lock+0x71/0xc0 [ 64.169977] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 64.169977] release_sock+0xb0/0x170 [ 64.169977] udp_connect+0x43/0x50 [ 64.169977] __sys_connect+0xa6/0x100 [ 64.169977] ? alloc_fd+0x2e9/0x300 [ 64.169977] ? __pfx___sys_connect+0x10/0x10 [ 64.169977] ? preempt_latency ---truncated---

Executive ViewAI

Why It Matters

Linux systems managing IPsec network policies are vulnerable to a kernel flaw that could expose kernel memory to local attackers and destabilize critical infrastructure. Exploitation code is publicly available, making the risk tangible for environments with privileged users who can modify network policies. Patch availability is the priority-delay increases risk in cloud, enterprise, and hybrid deployments.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 95% exploitable

Prevalence

Ubiquitous

core OS kernel powering virtually all Linux servers, containers, and cloud workloads

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +36

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-68420 ADVISORY https://ubuntu.com/security/notices/USN-8887-1 ADVISORY https://ubuntu.com/security/notices/USN-8888-1 ADVISORY https://ubuntu.com/security/notices/USN-8889-1 REF https://git.kernel.org/stable/c/9333f4b6f44858fc98eb12bf26b8d2959eb975d5 REF https://git.kernel.org/stable/c/d7fc6f351c478586980a521d63b0214d9c055e78 REF https://git.kernel.org/stable/c/ea528f18231ec0f33317be57f8866913b19aba6e

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back