{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-63911",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2026-07-19T07:54:57.020Z",
        "datePublished": "2026-07-19T14:55:16.496Z",
        "dateUpdated": "2026-08-05T12:37:05.089Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T12:37:05.089Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: iptfs: reset runtime state when cloning SAs\n\niptfs_clone_state() clones the IPTFS mode data with kmemdup(). This\ncopies runtime objects which must not be shared with the original SA,\nincluding the embedded sk_buff_head, hrtimers, spinlock, and in-flight\nreassembly/reorder state.\n\nIf xfrm_state_migrate() fails after clone_state() but before the later\ninit_state() call has reinitialized those fields, the cloned state can be\ndestroyed by xfrm_state_gc_task() with list and timer state copied from the\noriginal SA. With queued packets this lets the clone splice and free skbs\nowned by the original IPTFS queue, leading to use-after-free and\ndouble-free reports in iptfs_destroy_state() and skb release paths.\n\nReinitialize the clone's runtime state before publishing it through\nx->mode_data. Because clone_state() now publishes a destroyable mode_data\nobject before init_state(), take the mode callback module reference there.\nAvoid taking it again from __iptfs_init_state() for the same object."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - The bug is reached only through local XFRM SA migration via netlink XFRM_MSG_MIGRATE or PF_KEY SADB_X_MIGRATE, not by processing remote network packets alone.\nAC:L - On systems with IPTFS and XFRM_MIGRATE enabled, an attacker who controls the migrate request can reliably queue skbs on the SA and force a post-clone migration failure to trigger the shared-queue teardown.\nPR:L - All XFRM migrate operations require CAP_NET_ADMIN on the target network namespace, which unprivileged users can obtain inside a user namespace via unshare.\nUI:N - Exploitation requires no victim interaction beyond the attacker’s own netlink/PF_KEY operations and traffic through an SA they control.\nS:U - Impact is kernel memory corruption and privilege escalation within the same kernel security authority, not a cross-VM or cross-IOMMU boundary escape.\nC:H - The bug is a use-after-free on sk_buff objects where the clone’s destroy path frees skbs still owned by the live original IPTFS queue, enabling arbitrary kernel memory read primitives.\nI:H - Shared queue/timer state corruption and skb double-free provide exploitable heap corruption that can be leveraged for arbitrary kernel writes or code execution.\nA:H - The vulnerability causes kernel oops/panic from UAF and double-free in skb release paths, and can be used for repeatable denial of service against the host."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "net/xfrm/xfrm_iptfs.c"
                    ],
                    "versions": [
                        {
                            "version": "0e4fbf013fa566f274ce9b4ce698c75b1f998c52",
                            "lessThan": "9327252e04626d4bb02ca8c0c108fbe8eabf0c5a",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "0e4fbf013fa566f274ce9b4ce698c75b1f998c52",
                            "lessThan": "dfb9f6cbfa9826655a49698cf90eb800fce2178e",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "0e4fbf013fa566f274ce9b4ce698c75b1f998c52",
                            "lessThan": "7f83d174073234839aea176f265e517e0d50a1d2",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "net/xfrm/xfrm_iptfs.c"
                    ],
                    "versions": [
                        {
                            "version": "6.14",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.14",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18.35",
                            "lessThanOrEqual": "6.18.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.0.12",
                            "lessThanOrEqual": "7.0.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.1",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.14",
                                    "versionEndExcluding": "6.18.35"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.14",
                                    "versionEndExcluding": "7.0.12"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.14",
                                    "versionEndExcluding": "7.1"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/9327252e04626d4bb02ca8c0c108fbe8eabf0c5a"
                },
                {
                    "url": "https://git.kernel.org/stable/c/dfb9f6cbfa9826655a49698cf90eb800fce2178e"
                },
                {
                    "url": "https://git.kernel.org/stable/c/7f83d174073234839aea176f265e517e0d50a1d2"
                }
            ],
            "title": "xfrm: iptfs: reset runtime state when cloning SAs",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}