CVE-2026-68420

In the Linux kernel, the following vulnerability has been resolved:

xfrm: reject optional IPTFS templates in outbound policies

syzbot reported a stack-out-of-bounds read in xfrmstatefind() which flows from xfrmtmplresolve_one().

Commit 3d776e31c841 ("xfrm: Reject optional tunnel/BEET mode templates in outbound policies") disallowed optional tunnel and BEET in outbound policies to prevent this. Later when IPTFS added, it was not covered by that fix and can still trigger the out-of-bounds read;

Extend the check to disallow optional IPTFS in outbound policies as well. IPTFS should be identical to tunnel mode. IN and FWD policies are not affected: xfrmtmplresolve_one() is only reachable via the outbound path.

Reproducer, before:

ip link add dummy0 type dummy ip link set dummy0 up ip addr add 10.1.1.1/24 dev dummy0 ip xfrm policy add src 10.1.1.1/32 dst 10.1.1.2/32 dir out tmpl src fc00::dead:1 dst fc00::dead:2 proto esp reqid 1 mode iptfs level use tmpl src fc00::dead:1 dst fc00::dead:2 proto esp reqid 2 mode transport ping -W 1 -c 1 10.1.1.2 PING 10.1.1.2 (10.1.1.2) 56(84) bytes of data.

[ 64.168420] ================================================================== [ 64.169977] BUG: KASAN: stack-out-of-bounds in __xfrm6addrhash+0x11e/0x170 [ 64.169977] Read of size 4 at addr ffff88800e1ffd20 by task ping/2844

[ 64.169977] CPU: 2 UID: 0 PID: 2844 Comm: ping Not tainted 7.1.0-rc7-00180-geb23b588430a #98 PREEMPT(full) [ 64.169977] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 64.169977] Call Trace: [ 64.169977] <TASK> [ 64.169977] dumpstacklvl+0x47/0x70 [ 64.169977] ? __xfrm6addrhash+0x11e/0x170 [ 64.169977] printreport+0x152/0x4b0 [ 64.169977] ? ksysmmappgoff+0x6d/0xa0 [ 64.169977] ? entrySYSCALL64afterhwframe+0x76/0x7e [ 64.169977] ? rcureadunlocksched+0xa/0x20 [ 64.169977] ? __virtaddrvalid+0x21b/0x230 [ 64.169977] ? __xfrm6addrhash+0x11e/0x170 [ 64.169977] kasan_report+0xa8/0xd0 [ 64.169977] ? __xfrm6addrhash+0x11e/0x170 [ 64.169977] __xfrm6addrhash+0x11e/0x170 [ 64.169977] __xfrmdsthash+0x24/0xc0 [ 64.169977] xfrmstatefind+0xa2d/0x2f90 [ 64.169977] ? __pfxxfrmstate_find+0x10/0x10 [ 64.169977] ? __pfxftracegraphretaddr+0x10/0x10 [ 64.169977] ? __pfxftracegraphretaddr+0x10/0x10 [ 64.169977] xfrm_tmplresolveone+0x210/0x570 [ 64.169977] ? __pfxxfrmtmplresolveone+0x10/0x10 [ 64.169977] ? __pfxstacktraceconsumeentry+0x10/0x10 [ 64.169977] ? kerneltextaddress+0x5b/0x80 [ 64.169977] ? __kerneltextaddress+0xe/0x30 [ 64.169977] ? unwind_getreturnaddress+0x5e/0x90 [ 64.169977] ? archstackwalk+0x8c/0xe0 [ 64.169977] xfrmtmplresolve+0x130/0x200 [ 64.169977] ? __pfxxfrmtmpl_resolve+0x10/0x10 [ 64.169977] ? __pfxxfrmpolicy_inexactlookuprcu+0x10/0x10 [ 64.169977] ? __refcountaddnot_zero.constprop.0+0xb2/0x110 [ 64.169977] ? pfxrefcountaddnotzero.constprop.0+0x10/0x10 [ 64.169977] xfrmresolveandcreatebundle+0xd5/0x310 [ 64.169977] ? __pfxxfrmresolve_andcreatebundle+0x10/0x10 [ 64.169977] ? __pfxxfrmpolicylookupbytype+0x10/0x10 [ 64.169977] ? __pfxxfrmpolicylookupbytype+0x10/0x10 [ 64.169977] xfrmlookupwith_ifid+0x3d8/0xb80 [ 64.169977] ? __pfxxfrmlookupwithifid+0x10/0x10 [ 64.169977] ? iprouteoutputkeyhash+0xc6/0x110 [ 64.169977] ? kasansavetrack+0x10/0x30 [ 64.169977] xfrmlookuproute+0x18/0xe0 [ 64.169977] ip4datagramrelease_cb+0x4c9/0x530 [ 64.169977] ? __pfxip4datagramreleasecb+0x10/0x10 [ 64.169977] ? dorawspin_lock+0x71/0xc0 [ 64.169977] ? __pfxdorawspinlock+0x10/0x10 [ 64.169977] releasesock+0xb0/0x170 [ 64.169977] udpconnect+0x43/0x50 [ 64.169977] __sysconnect+0xa6/0x100 [ 64.169977] ? allocsysconnect+0xa6/0x100 [ 64.169977] ? allocfd+0x2e9/0x300 [ 64.169977] ? pfxysconnect+0x10/0x10 [ 64.169977] ? preemptlatency ---truncated---