CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 4.16affected
  • f53c723902d1ac5f0b0a11d7c9dcbff748dde74e and later · before 4e695742396be18d5291c310a3d7c450959d647aaffected · git
  • f53c723902d1ac5f0b0a11d7c9dcbff748dde74e and later · before 4927ab8a8acc8db4fad33e803d1d35e0b16cef83affected · git
  • f53c723902d1ac5f0b0a11d7c9dcbff748dde74e and later · before b58731e0570bfd3989999fc2baf9ee4fecd5bec6affected · git
  • f53c723902d1ac5f0b0a11d7c9dcbff748dde74e and later · before 33e1b0d25ca0d2818c635ff80e6aa0d295e08a98affected · git
  • f53c723902d1ac5f0b0a11d7c9dcbff748dde74e and later · before bbca7cc3b2b4b10afbfee99b81d9ee78f5423046affected · git
  • f53c723902d1ac5f0b0a11d7c9dcbff748dde74e and later · before 3f4c3919baf0944ad96580467c302bc6c7758b00affected · git
  • before 4.16not affected · semver
  • 6.1.191 and later · up to and including 6.1.*not affected · semver
  • 6.6.160 and later · up to and including 6.6.*not affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-74705udp: fix potential use-after-free in tunnel segmentation
  40Plan
• CVE-2026-74612veth: fix skb length accounting after XDP frag adjustment
  40Plan
• CVE-2026-74475vxlan: use neigh_ha_snapshot() in route_shortcircuit()
  40Plan

Published before and after this one in the same product

• ← EarlierCVE-2026-68421Aug 10, 2026 · sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()
  0Monitor
• ← EarlierCVE-2026-68425Aug 10, 2026 · IB/mad: Drop unmatched RMPP responses before reassembly
  28Monitor
• Later →CVE-2026-68427Aug 10, 2026 · gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
  31Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.