CVE-2026-63911

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfrm: iptfs: reset runtime state when cloning SAs<br /> <br /> iptfs_clone_state() clones the IPTFS mode data with kmemdup(). This<br /> copies runtime objects which must not be shared with the original SA,<br /> including the embedded sk_buff_head, hrtimers, spinlock, and in-flight<br /> reassembly/reorder state.<br /> <br /> If xfrm_state_migrate() fails after clone_state() but before the later<br /> init_state() call has reinitialized those fields, the cloned state can be<br /> destroyed by xfrm_state_gc_task() with list and timer state copied from the<br /> original SA. With queued packets this lets the clone splice and free skbs<br /> owned by the original IPTFS queue, leading to use-after-free and<br /> double-free reports in iptfs_destroy_state() and skb release paths.<br /> <br /> Reinitialize the clone&amp;#39;s runtime state before publishing it through<br /> x-&gt;mode_data. Because clone_state() now publishes a destroyable mode_data<br /> object before init_state(), take the mode callback module reference there.<br /> Avoid taking it again from __iptfs_init_state() for the same object.