CVE-2026-68426

In the Linux kernel, the following vulnerability has been resolved:

xfrm: fix stale skb->prev after async crypto steals a GSO segment

skbgsosegment() leaves the segment list head with ->prev pointing at

the last segment, an invariant validatexmitskb_list() relies on when

it sets its tail pointer (tail = skb->prev).

When validatexmitxfrm() walks a GSO list and some segments are stolen

by async crypto (->xmit() returns -EINPROGRESS), those segments are

unlinked from the list but the head ->prev is never updated.  If the

last segment is the one stolen, the returned head still has ->prev

pointing at it, even though it is now owned by the crypto engine and may

be freed.  validatexmitskb_list() later does tail->next = skb, writing

through that stale pointer -- a use-after-free.

Repoint skb->prev at the last retained segment before returning.