CVE-2026-68415

A flaw was found in the Linux kernel's xfrm (IPSec framework) component. A vulnerability exists where the xfrm_state_gc_task can attempt to dereference stale callback data after a failed Internet Protocol Traffic Flow Security (IPTFS) state setup and subsequent module unload. This can lead to a kernel panic and system crash, resulting in a Denial of Service (DoS) for the affected system.

This vulnerability is rated as Moderate impact because exploitation requires local access with administrative privileges to manage network configurations, combined with specific timing conditions during failed state initialization. Successful exploitation can only lead to a kernel crash and resulting denial of service, without granting arbitrary code execution or information disclosure. Additionally, the affected IPTFS feature was introduced in newer upstream kernel releases and is not present in supported Red Hat Enterprise Linux kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.