DEBIAN-CVE-2026-68426

In the Linux kernel, the following vulnerability has been resolved:  xfrm: fix stale skb->prev after async crypto steals a GSO segment  skbgsosegment() leaves the segment list head with ->prev pointing at the last segment, an invariant validatexmitskblist() relies on when it sets its tail pointer (tail = skb->prev).  When validatexmitxfrm() walks a GSO list and some segments are stolen by async crypto (->xmit() returns -EINPROGRESS), those segments are unlinked from the list but the head ->prev is never updated.  If the last segment is the one stolen, the returned head still has ->prev pointing at it, even though it is now owned by the crypto engine and may be freed.  validatexmitskblist() later does tail->next = skb, writing through that stale pointer -- a use-after-free.  Repoint skb->prev at the last retained segment before returning.