CVE-2026-63911

In the Linux kernel, the following vulnerability has been resolved:

xfrm: iptfs: reset runtime state when cloning SAs

iptfsclonestate() clones the IPTFS mode data with kmemdup(). This copies runtime objects which must not be shared with the original SA, including the embedded skbuffhead, hrtimers, spinlock, and in-flight reassembly/reorder state.

If xfrmstatemigrate() fails after clonestate() but before the later initstate() call has reinitialized those fields, the cloned state can be destroyed by xfrmstategctask() with list and timer state copied from the original SA. With queued packets this lets the clone splice and free skbs owned by the original IPTFS queue, leading to use-after-free and double-free reports in iptfsdestroy_state() and skb release paths.

Reinitialize the clone's runtime state before publishing it through x->modedata. Because clonestate() now publishes a destroyable modedata object before initstate(), take the mode callback module reference there. Avoid taking it again from __iptfsinitstate() for the same object.