CVE-2026-68420

A flaw was found in the Linux kernel's xfrm component. A local user could trigger a stack-out-of-bounds read by configuring an outbound Internet Protocol Security (IPsec) policy with optional IPsec Flow Template Specification (IPTFS) templates. This vulnerability can lead to a system crash, resulting in a Denial of Service (DoS).

This vulnerability is rated as having a Moderate severity because exploitation requires local administrative privileges or access to unprivileged user namespaces to manipulate network policies, limiting the blast radius to a denial of service. Additionally, the IPsec Flow Template Specification feature was only introduced in newer upstream kernels and is not supported or present in standard Red Hat Enterprise Linux releases. As a result, default enterprise deployments are not exposed to this flaw under normal operating conditions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.