CVE-2026-68377: net/sched: act_tunnel_key: Defer dst_release to RCU callback

Published Aug 10, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

net/sched: acttunnelkey: Defer dstrelease to RCU callback

Fix a race-condition use-after-free in tunnelkeyreleaseparams().

The function releases the metadatadst of the old params synchronously via dstrelease() while deferring the params struct free with kfreercu(). A concurrent tunnelkeyact() reader on the datapath may still hold the old params pointer (under rcureadlockbh) and proceed to call dstclone(&params->tcftencmetadata->dst) after the writer's dstrelease has already pushed the dst's rcuref to RCUREFDEAD.

zdi-disclosures produced a poc which i (and Victor) verified that KASAN reports:

================================================================== BUG: KASAN: slab-use-after-free in instrumentatomicreadwrite include/linux/instrumented.h:112 BUG: KASAN: slab-use-after-free in atomicsubreturnrelease include/linux/atomic/atomic-instrumented.h:326 BUG: KASAN: slab-use-after-free in rcurefput include/linux/rcuref.h:109 BUG: KASAN: slab-use-after-free in rcurefput include/linux/rcuref.h:173 BUG: KASAN: slab-use-after-free in dstrelease+0x5b/0x370 net/core/dst.c:168 Write of size 4 at addr ffff88806158de40 by task poc/9388

CPU: 0 UID: 0 PID: 9388 Comm: poc Tainted: G W 7.1.0-rc7 #7 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dumpstack lib/dumpstack.c:94 dumpstacklvl+0x100/0x190 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:378 printreport+0x139/0x4ad mm/kasan/report.c:482 kasanreport+0xe4/0x1d0 mm/kasan/report.c:595 checkregioninline mm/kasan/generic.c:186 kasancheckrange+0x125/0x200 mm/kasan/generic.c:200 instrumentatomicreadwrite include/linux/instrumented.h:112 atomicsubreturnrelease include/linux/atomic/atomic-instrumented.h:326 rcurefput include/linux/rcuref.h:109 rcurefput include/linux/rcuref.h:173 dstrelease+0x5b/0x370 net/core/dst.c:168 refdstdrop include/net/dst.h:272 skbdstdrop include/net/dst.h:284 skbreleaseheadstate+0x293/0x400 net/core/skbuff.c:1163 skbreleaseall net/core/skbuff.c:1187 [..] Allocated by task 9391: kasansavestack+0x30/0x50 mm/kasan/common.c:57 kasansavetrack+0x14/0x30 mm/kasan/common.c:78 poisonkmallocredzone mm/kasan/common.c:398 kasankmalloc+0x9a/0xb0 mm/kasan/common.c:415 kasankmalloc include/linux/kasan.h:263 dokmallocnode mm/slub.c:5296 kmallocnoprof+0x2f1/0x830 mm/slub.c:5308 kmallocnoprof include/linux/slab.h:954 kzallocnoprof include/linux/slab.h:1188 offloadactionalloc+0x2f/0x130 net/core/flowoffload.c:35 tcfactionoffloadaddex+0x1ba/0x880 net/sched/actapi.c:258 tcfactionoffloadadd net/sched/actapi.c:293 tcfactioninit+0x66e/0xa20 net/sched/actapi.c:1547 tcfactionadd+0xf6/0x5d0 net/sched/actapi.c:2101 [..] Freed by task 9391: kasansavestack+0x30/0x50 mm/kasan/common.c:57 kasansavetrack+0x14/0x30 mm/kasan/common.c:78 kasansavefreeinfo+0x3b/0x70 mm/kasan/generic.c:584 poisonslabobject mm/kasan/common.c:253 kasanslabfree+0x6b/0x90 mm/kasan/common.c:285 kasanslabfree include/linux/kasan.h:235 slabfreehook mm/slub.c:2689 slabfree mm/slub.c:6251 kfree+0x21f/0x6b0 mm/slub.c:6566 tcfactionoffloadaddex+0x4ad/0x880 net/sched/actapi.c:284 tcfactionoffloadadd net/sched/actapi.c:293 tcfactioninit+0x66e/0xa20 net/sched/actapi.c:1547 tcfactionadd+0xf6/0x5d0 net/sched/actapi.c:2101

The buggy address belongs to the object at ffff88806158de00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 64 bytes inside of freed 256-byte region [ffff88806158de00, ffff88806158df00)

The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806158d600 pfn:0x6158c head: order:1 mapcount:0 entiremap ---truncated---

Other sources

In the Linux kernel, the following vulnerability has been resolved:

net/sched: acttunnelkey: Defer dstrelease to RCU callback

Fix a race-condition use-after-free in tunnelkeyreleaseparams().

The function releases the metadatadst of the old params synchronously via dstrelease() while deferring the params struct free with kfreercu(). A concurrent tunnelkeyact() reader on the datapath may still hold the old params pointer (under rcureadlockbh) and proceed to call dstclone(&params->tcftencmetadata->dst) after the writer's dstrelease has already pushed the dst's rcuref to RCUREFDEAD.

zdi-disclosures@trendmicro.com produced a poc which i (and Victor) verified that KASAN reports:

================================================================== BUG: KASAN: slab-use-after-free in instrumentatomicreadwrite include/linux/instrumented.h:112 BUG: KASAN: slab-use-after-free in atomicsubreturnrelease include/linux/atomic/atomic-instrumented.h:326 BUG: KASAN: slab-use-after-free in rcurefput include/linux/rcuref.h:109 BUG: KASAN: slab-use-after-free in rcurefput include/linux/rcuref.h:173 BUG: KASAN: slab-use-after-free in dstrelease+0x5b/0x370 net/core/dst.c:168 Write of size 4 at addr ffff88806158de40 by task poc/9388

CPU: 0 UID: 0 PID: 9388 Comm: poc Tainted: G W 7.1.0-rc7 #7 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dumpstack lib/dumpstack.c:94 dumpstacklvl+0x100/0x190 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:378 printreport+0x139/0x4ad mm/kasan/report.c:482 kasanreport+0xe4/0x1d0 mm/kasan/report.c:595 checkregioninline mm/kasan/generic.c:186 kasancheckrange+0x125/0x200 mm/kasan/generic.c:200 instrumentatomicreadwrite include/linux/instrumented.h:112 atomicsubreturnrelease include/linux/atomic/atomic-instrumented.h:326 rcurefput include/linux/rcuref.h:109 rcurefput include/linux/rcuref.h:173 dstrelease+0x5b/0x370 net/core/dst.c:168 refdstdrop include/net/dst.h:272 skbdstdrop include/net/dst.h:284 skbreleaseheadstate+0x293/0x400 net/core/skbuff.c:1163 skbreleaseall net/core/skbuff.c:1187 [..] Allocated by task 9391: kasansavestack+0x30/0x50 mm/kasan/common.c:57 kasansavetrack+0x14/0x30 mm/kasan/common.c:78 poisonkmallocredzone mm/kasan/common.c:398 kasankmalloc+0x9a/0xb0 mm/kasan/common.c:415 kasankmalloc include/linux/kasan.h:263 dokmallocnode mm/slub.c:5296 kmallocnoprof+0x2f1/0x830 mm/slub.c:5308 kmallocnoprof include/linux/slab.h:954 kzallocnoprof include/linux/slab.h:1188 offloadactionalloc+0x2f/0x130 net/core/flowoffload.c:35 tcfactionoffloadaddex+0x1ba/0x880 net/sched/actapi.c:258 tcfactionoffloadadd net/sched/actapi.c:293 tcfactioninit+0x66e/0xa20 net/sched/actapi.c:1547 tcfactionadd+0xf6/0x5d0 net/sched/actapi.c:2101 [..] Freed by task 9391: kasansavestack+0x30/0x50 mm/kasan/common.c:57 kasansavetrack+0x14/0x30 mm/kasan/common.c:78 kasansavefreeinfo+0x3b/0x70 mm/kasan/generic.c:584 poisonslabobject mm/kasan/common.c:253 kasanslabfree+0x6b/0x90 mm/kasan/common.c:285 kasanslabfree include/linux/kasan.h:235 slabfreehook mm/slub.c:2689 slabfree mm/slub.c:6251 kfree+0x21f/0x6b0 mm/slub.c:6566 tcfactionoffloadaddex+0x4ad/0x880 net/sched/actapi.c:284 tcfactionoffloadadd net/sched/actapi.c:293 tcfactioninit+0x66e/0xa20 net/sched/actapi.c:1547 tcfactionadd+0xf6/0x5d0 net/sched/actapi.c:2101

The buggy address belongs to the object at ffff88806158de00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 64 bytes inside of freed 256-byte region [ffff88806158de00, ffff88806158df00)

The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806158d600 pfn:0x6158c head: order:1 mapcount:0 entiremap ---truncated---

— MITRE

Affected Software

229 affected componentsFixes available
Linux Kernel
Microsoft azl3 kernel 6.6.143.1-1<6.6.150.1-1
6.6.150.1-1
ubuntu/linux-hwe-edge*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-aws-5.4*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-5.4*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gcp-5.4*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-5.4*
ubuntu/linux-hwe-edge*
ubuntu/linux-ibm-5.4*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-oracle-5.4*
ubuntu/linux-raspi-5.4*
ubuntu/linux*
ubuntu/linux-aws*
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.15<5.15.0-1117.124~20.04.1
5.15.0-1117.124~20.04.1
ubuntu/linux-aws-5.8*
ubuntu/linux-azure*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.15<5.15.0-1123.132~20.04.1
5.15.0-1123.132~20.04.1
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-azure-fde-5.15<5.15.0-1122.131~20.04.1
5.15.0-1122.131~20.04.1
ubuntu/linux-bluefield*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.15<5.15.0-1118.128~20.04.1
5.15.0-1118.128~20.04.1
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.15<5.15.0-198.208~20.04.1
5.15.0-198.208~20.04.1
ubuntu/linux-hwe-5.8*
ubuntu/linux-ibm*
ubuntu/linux-ibm-5.15<5.15.0-1111.115~20.04.1
5.15.0-1111.115~20.04.1
ubuntu/linux-intel-5.13*
ubuntu/linux-intel-iotg-5.15<5.15.0-1112.118~20.04.1
5.15.0-1112.118~20.04.1
ubuntu/linux-iot*
ubuntu/linux-kvm*
ubuntu/linux-lowlatency-hwe-5.15<5.15.0-195.205~20.04.1
5.15.0-195.205~20.04.1
ubuntu/linux-nvidia-tegra-5.15<5.15.0-1070.72~20.04.1
5.15.0-1070.72~20.04.1
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.15<5.15.0-1114.120~20.04.1
5.15.0-1114.120~20.04.1
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.15<5.15.0-1111.115~20.04.1
5.15.0-1111.115~20.04.1
ubuntu/linux-riscv-5.8*
ubuntu/linux-xilinx-zynqmp*
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.15.0-198.208
5.15.0-198.208
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws<5.15.0-1117.124
5.15.0-1117.124
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-aws-6.8<6.8.0-1069.74~22.04.1
6.8.0-1069.74~22.04.1
ubuntu/linux-azure<5.15.0-1123.132
5.15.0-1123.132
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-6.8<6.8.0-1073.82~22.04.1
6.8.0-1073.82~22.04.1
ubuntu/linux-azure-fde<5.15.0-1122.131
5.15.0-1122.131
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-azure-fde-6.8<6.8.0-1071.78~22.04.1
6.8.0-1071.78~22.04.1
ubuntu/linux-gcp<5.15.0-1118.128
5.15.0-1118.128
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gcp-6.8<6.8.0-1073.81~22.04.1
6.8.0-1073.81~22.04.1
ubuntu/linux-gke<5.15.0-1113.119
5.15.0-1113.119
ubuntu/linux-gkeop<5.15.0-1100.108
5.15.0-1100.108
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-ibm<5.15.0-1111.115
5.15.0-1111.115
ubuntu/linux-ibm-6.8<6.8.0-1069.70~22.04.1
6.8.0-1069.70~22.04.1
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-intel-iotg<5.15.0-1112.118
5.15.0-1112.118
ubuntu/linux-kvm<5.15.0-1109.114
5.15.0-1109.114
ubuntu/linux-lowlatency<5.15.0-195.205
5.15.0-195.205
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-lowlatency-hwe-6.8<6.8.0-149.149.1~22.04.1
6.8.0-149.149.1~22.04.1
ubuntu/linux-nvidia<5.15.0-1112.113
5.15.0-1112.113
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-nvidia-6.8*
ubuntu/linux-nvidia-tegra<5.15.0-1070.72
5.15.0-1070.72
ubuntu/linux-nvidia-tegra-igx<5.15.0-1059.59
5.15.0-1059.59
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle<5.15.0-1114.120
5.15.0-1114.120
ubuntu/linux-oracle-6.5*
ubuntu/linux-oracle-6.8<6.8.0-1067.71~22.04.1
6.8.0-1067.71~22.04.1
ubuntu/linux-raspi<5.15.0-1113.116
5.15.0-1113.116
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-xilinx-zynqmp<5.15.0-1080.84
5.15.0-1080.84
ubuntu/linux-bluefield<5.15.0-1101.103
5.15.0-1101.103
ubuntu/linux-intel-iot-realtime<5.15.0-1109.111
5.15.0-1109.111
ubuntu/linux-realtime<5.15.0-1116.125
5.15.0-1116.125
ubuntu/linux-realtime-6.8<6.8.1-1064.65~22.04.1
6.8.1-1064.65~22.04.1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-aws-fips<5.15.0-1117.124+fips1
5.15.0-1117.124+fips1
ubuntu/linux-azure-fips<5.15.0-1123.132+fips1
5.15.0-1123.132+fips1
ubuntu/linux-fips<5.15.0-198.208+fips1
5.15.0-198.208+fips1
ubuntu/linux-gcp-fips<5.15.0-1118.128+fips1
5.15.0-1118.128+fips1
ubuntu/linux<6.8.0-147.147
6.8.0-147.147
ubuntu/linux-aws<6.8.0-1067.70
6.8.0-1067.70
ubuntu/linux-aws-6.14*
ubuntu/linux-aws-6.17*
ubuntu/linux-aws-7.0<7.0.0-1014.14~24.04.1
7.0.0-1014.14~24.04.1
ubuntu/linux-azure<6.8.0-1071.79
6.8.0-1071.79
ubuntu/linux-azure-6.11*
ubuntu/linux-azure-6.14*
ubuntu/linux-azure-6.17*
ubuntu/linux-azure-7.0<7.0.0-1017.17~24.04.1
7.0.0-1017.17~24.04.1
ubuntu/linux-azure-fde<6.8.0-1069.76
6.8.0-1069.76
ubuntu/linux-azure-fde-6.14*
ubuntu/linux-azure-fde-6.17*
ubuntu/linux-azure-fde-7.0<7.0.0-1016.16~24.04.1
7.0.0-1016.16~24.04.1
ubuntu/linux-azure-nvidia*
ubuntu/linux-azure-nvidia-6.14*
ubuntu/linux-gcp<6.8.0-1071.79
6.8.0-1071.79
ubuntu/linux-gcp-6.11*
ubuntu/linux-gcp-6.14*
ubuntu/linux-gcp-7.0<7.0.0-1014.14~24.04.1
7.0.0-1014.14~24.04.1
ubuntu/linux-gke<6.8.0-1066.74
6.8.0-1066.74
ubuntu/linux-gkeop<6.8.0-1052.56
6.8.0-1052.56
ubuntu/linux-hwe-6.11*
ubuntu/linux-hwe-6.14*
ubuntu/linux-hwe-6.17*
ubuntu/linux-hwe-7.0<7.0.0-38.38~24.04.4
7.0.0-38.38~24.04.4
ubuntu/linux-ibm<6.8.0-1067.68
6.8.0-1067.68
ubuntu/linux-lowlatency<6.8.0-147.147.1
6.8.0-147.147.1
ubuntu/linux-lowlatency-hwe-6.11*
ubuntu/linux-nvidia<6.8.0-1067.70
6.8.0-1067.70
ubuntu/linux-nvidia-6.11*
ubuntu/linux-nvidia-6.17*
ubuntu/linux-nvidia-7.0<7.0.0-1024.25~24.04.1
7.0.0-1024.25~24.04.1
ubuntu/linux-nvidia-lowlatency*
ubuntu/linux-nvidia-tegra<6.8.0-1036.39
6.8.0-1036.39
ubuntu/linux-oem-6.11*
ubuntu/linux-oem-6.14*
ubuntu/linux-oem-6.17*
ubuntu/linux-oem-6.8*
ubuntu/linux-oracle<6.8.0-1064.67
6.8.0-1064.67
ubuntu/linux-oracle-6.14*
ubuntu/linux-oracle-6.17*
ubuntu/linux-oracle-7.0<7.0.0-1013.13~24.04.1
7.0.0-1013.13~24.04.1
ubuntu/linux-raspi<6.8.0-1068.72
6.8.0-1068.72
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-6.14*
ubuntu/linux-riscv-6.17*
ubuntu/linux-riscv-7.0<7.0.0-38.38.1~24.04.1
7.0.0-38.38.1~24.04.1
ubuntu/linux-vmware<6.8.0-1008.8
6.8.0-1008.8
ubuntu/linux-xilinx*
ubuntu/linux-bluefield<6.8.0-1033.38
6.8.0-1033.38
ubuntu/linux-raspi-realtime<6.8.0-2056.58
6.8.0-2056.58
ubuntu/linux-realtime<6.8.1-1062.63
6.8.1-1062.63
ubuntu/linux-realtime-6.14*
ubuntu/linux-realtime-6.17*
ubuntu/linux-aws-fips<6.8.0-1067.70+fips1
6.8.0-1067.70+fips1
ubuntu/linux-azure-fips<6.8.0-1071.79+fips1
6.8.0-1071.79+fips1
ubuntu/linux-fips<6.8.0-147.147+fips1
6.8.0-147.147+fips1
ubuntu/linux-gcp-fips<6.8.0-1071.79+fips1
6.8.0-1071.79+fips1
ubuntu/linux<7.0.0-38.38
7.0.0-38.38
ubuntu/linux-aws<7.0.0-1014.14
7.0.0-1014.14
ubuntu/linux-azure<7.0.0-1017.17
7.0.0-1017.17
ubuntu/linux-azure-fde<7.0.0-1016.16
7.0.0-1016.16
ubuntu/linux-gcp<7.0.0-1014.14
7.0.0-1014.14
ubuntu/linux-gke<7.0.0-1008.9
7.0.0-1008.9
ubuntu/linux-ibm<7.0.0-1015.15
7.0.0-1015.15
ubuntu/linux-nvidia*
ubuntu/linux-nvidia-bos<7.0.0-2022.23
7.0.0-2022.23
ubuntu/linux-oem-7.0<7.0.0-1015.15
7.0.0-1015.15
ubuntu/linux-oracle<7.0.0-1013.13
7.0.0-1013.13
ubuntu/linux-raspi*
ubuntu/linux-realtime<7.0.0-38.38.1
7.0.0-38.38.1
ubuntu/linux-riscv<7.0.0-38.38.1
7.0.0-38.38.1
ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 6.6.150.1-1
  2. Upgrade

    Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1117.124~20.04.1
  3. Upgrade

    Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1123.132~20.04.1
  4. Upgrade

    Upgrade ubuntu/linux-azure-fde-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1122.131~20.04.1
  5. Upgrade

    Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1118.128~20.04.1
  6. Upgrade

    Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-198.208~20.04.1
  7. Upgrade

    Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1111.115~20.04.1
  8. Upgrade

    Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1112.118~20.04.1
  9. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-195.205~20.04.1
  10. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1070.72~20.04.1
  11. Upgrade

    Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1114.120~20.04.1
  12. Upgrade

    Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1111.115~20.04.1
  13. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.15.0-198.208
  14. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.15.0-1117.124
  15. Upgrade

    Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1069.74~22.04.1
  16. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.15.0-1123.132
  17. Upgrade

    Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1073.82~22.04.1
  18. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 5.15.0-1122.131
  19. Upgrade

    Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1071.78~22.04.1
  20. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1118.128
  21. Upgrade

    Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1073.81~22.04.1
  22. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 5.15.0-1113.119
  23. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.15.0-1100.108
  24. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1111.115
  25. Upgrade

    Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1069.70~22.04.1
  26. Upgrade

    Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.

    Fixed in 5.15.0-1112.118
  27. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1109.114
  28. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 5.15.0-195.205
  29. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-149.149.1~22.04.1
  30. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 5.15.0-1112.113
  31. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 5.15.0-1070.72
  32. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.

    Fixed in 5.15.0-1059.59
  33. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.15.0-1114.120
  34. Upgrade

    Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.0-1067.71~22.04.1
  35. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.15.0-1113.116
  36. Upgrade

    Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1080.84
  37. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.15.0-1101.103
  38. Upgrade

    Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1109.111
  39. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1116.125
  40. Upgrade

    Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.

    Fixed in 6.8.1-1064.65~22.04.1
  41. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1117.124+fips1
  42. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1123.132+fips1
  43. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-198.208+fips1
  44. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1118.128+fips1
  45. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.8.0-147.147
  46. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.8.0-1067.70
  47. Upgrade

    Upgrade ubuntu/linux-aws-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1014.14~24.04.1
  48. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.8.0-1071.79
  49. Upgrade

    Upgrade ubuntu/linux-azure-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1017.17~24.04.1
  50. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 6.8.0-1069.76
  51. Upgrade

    Upgrade ubuntu/linux-azure-fde-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1016.16~24.04.1
  52. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.8.0-1071.79
  53. Upgrade

    Upgrade ubuntu/linux-gcp-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1014.14~24.04.1
  54. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 6.8.0-1066.74
  55. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 6.8.0-1052.56
  56. Upgrade

    Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-38.38~24.04.4
  57. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 6.8.0-1067.68
  58. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-147.147.1
  59. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 6.8.0-1067.70
  60. Upgrade

    Upgrade ubuntu/linux-nvidia-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1024.25~24.04.1
  61. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 6.8.0-1036.39
  62. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.8.0-1064.67
  63. Upgrade

    Upgrade ubuntu/linux-oracle-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1013.13~24.04.1
  64. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.8.0-1068.72
  65. Upgrade

    Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-38.38.1~24.04.1
  66. Upgrade

    Upgrade ubuntu/linux-vmware to a version that resolves this vulnerability.

    Fixed in 6.8.0-1008.8
  67. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 6.8.0-1033.38
  68. Upgrade

    Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.0-2056.58
  69. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.1-1062.63
  70. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1067.70+fips1
  71. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1071.79+fips1
  72. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-147.147+fips1
  73. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1071.79+fips1
  74. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 7.0.0-38.38
  75. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 7.0.0-1014.14
  76. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 7.0.0-1017.17
  77. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 7.0.0-1016.16
  78. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 7.0.0-1014.14
  79. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 7.0.0-1008.9
  80. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 7.0.0-1015.15
  81. Upgrade

    Upgrade ubuntu/linux-nvidia-bos to a version that resolves this vulnerability.

    Fixed in 7.0.0-2022.23
  82. Upgrade

    Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1015.15
  83. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 7.0.0-1013.13
  84. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 7.0.0-38.38.1
  85. Upgrade

    Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.

    Fixed in 7.0.0-38.38.1
  86. Compensating control

    In net/sched/act_tunnel_key, fix the race in tunnel_key_release_params() by deferring dst_release() to an RCU callback rather than releasing the metadata_dst synchronously.

Event History

Aug 10, 2026
CVE Published
via MITRE·12:03 PM
Data Sourced
via MITRE·12:03 PM
DescriptionSeverity
Data Sourced
via Red Hat·12:28 PM
DescriptionSeverityAffected Software
Data Sourced
via OSV·01:20 PM
DescriptionSeverityAffected Software
Event
via OSV·01:20 PM
Data Sourced
via NVD·01:20 PM
DescriptionSeverityWeakness
Aug 11, 2026
Data Sourced
via Microsoft·08:15 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·08:15 AM
Affected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-68377?

CVE-2026-68377 has a risk score of 60, indicating a moderate severity level.

2

What is the nature of the vulnerability in CVE-2026-68377?

CVE-2026-68377 involves a race-condition use-after-free vulnerability in the Linux kernel's tunnel_key_release_params function.

3

How do I fix CVE-2026-68377?

To fix CVE-2026-68377, update to the latest patched version of the Linux kernel that addresses this vulnerability.

4

Which component of the Linux kernel is affected by CVE-2026-68377?

The vulnerability CVE-2026-68377 affects the act_tunnel_key component of the Linux kernel.

5

What could be the potential impact of exploiting CVE-2026-68377?

Exploiting CVE-2026-68377 could lead to unpredictable behavior in the kernel, potentially allowing for escalation of privileges or denial of service.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203