{"api_version":"1","generated_at":"2026-08-11T06:11:01+00:00","cve":"CVE-2026-68420","urls":{"html":"https://cve.report/CVE-2026-68420","api":"https://cve.report/api/cve/CVE-2026-68420.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-68420","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-68420"},"summary":{"title":"xfrm: reject optional IPTFS templates in outbound policies","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: reject optional IPTFS templates in outbound policies\n\nsyzbot reported a stack-out-of-bounds read in xfrm_state_find()\nwhich flows from xfrm_tmpl_resolve_one().\n\nCommit 3d776e31c841 (\"xfrm: Reject optional tunnel/BEET mode\ntemplates in outbound policies\") disallowed optional tunnel and\nBEET in outbound policies to prevent this. Later when IPTFS\nadded, it was not covered by that fix and can still trigger\nthe out-of-bounds read;\n\nExtend the check to disallow optional IPTFS in outbound policies\nas well. IPTFS should be identical to tunnel mode.\nIN and FWD policies are not affected: xfrm_tmpl_resolve_one()\nis only reachable via the outbound path.\n\nReproducer, before:\n\nip link add dummy0 type dummy\nip link set dummy0 up\nip addr add 10.1.1.1/24 dev dummy0\nip xfrm policy add src 10.1.1.1/32 dst 10.1.1.2/32 dir out tmpl\n  src fc00::dead:1 dst fc00::dead:2 proto esp reqid 1 mode iptfs\n  level use tmpl src fc00::dead:1 dst fc00::dead:2 proto esp reqid\n  2 mode transport\nping -W 1 -c 1 10.1.1.2\nPING 10.1.1.2 (10.1.1.2) 56(84) bytes of data.\n\n[   64.168420] ==================================================================\n[   64.169977] BUG: KASAN: stack-out-of-bounds in __xfrm6_addr_hash+0x11e/0x170\n[   64.169977] Read of size 4 at addr ffff88800e1ffd20 by task ping/2844\n\n[   64.169977] CPU: 2 UID: 0 PID: 2844 Comm: ping Not tainted 7.1.0-rc7-00180-geb23b588430a #98 PREEMPT(full)\n[   64.169977] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   64.169977] Call Trace:\n[   64.169977]  <TASK>\n[   64.169977]  dump_stack_lvl+0x47/0x70\n[   64.169977]  ? __xfrm6_addr_hash+0x11e/0x170\n[   64.169977]  print_report+0x152/0x4b0\n[   64.169977]  ? ksys_mmap_pgoff+0x6d/0xa0\n[   64.169977]  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   64.169977]  ? rcu_read_unlock_sched+0xa/0x20\n[   64.169977]  ? __virt_addr_valid+0x21b/0x230\n[   64.169977]  ? __xfrm6_addr_hash+0x11e/0x170\n[   64.169977]  kasan_report+0xa8/0xd0\n[   64.169977]  ? __xfrm6_addr_hash+0x11e/0x170\n[   64.169977]  __xfrm6_addr_hash+0x11e/0x170\n[   64.169977]  __xfrm_dst_hash+0x24/0xc0\n[   64.169977]  xfrm_state_find+0xa2d/0x2f90\n[   64.169977]  ? __pfx_xfrm_state_find+0x10/0x10\n[   64.169977]  ? __pfx_ftrace_graph_ret_addr+0x10/0x10\n[   64.169977]  ? __pfx_ftrace_graph_ret_addr+0x10/0x10\n[   64.169977]  xfrm_tmpl_resolve_one+0x210/0x570\n[   64.169977]  ? __pfx_xfrm_tmpl_resolve_one+0x10/0x10\n[   64.169977]  ? __pfx_stack_trace_consume_entry+0x10/0x10\n[   64.169977]  ? kernel_text_address+0x5b/0x80\n[   64.169977]  ? __kernel_text_address+0xe/0x30\n[   64.169977]  ? unwind_get_return_address+0x5e/0x90\n[   64.169977]  ? arch_stack_walk+0x8c/0xe0\n[   64.169977]  xfrm_tmpl_resolve+0x130/0x200\n[   64.169977]  ? __pfx_xfrm_tmpl_resolve+0x10/0x10\n[   64.169977]  ? __pfx_xfrm_policy_inexact_lookup_rcu+0x10/0x10\n[   64.169977]  ? __refcount_add_not_zero.constprop.0+0xb2/0x110\n[   64.169977]  ? __pfx___refcount_add_not_zero.constprop.0+0x10/0x10\n[   64.169977]  xfrm_resolve_and_create_bundle+0xd5/0x310\n[   64.169977]  ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10\n[   64.169977]  ? __pfx_xfrm_policy_lookup_bytype+0x10/0x10\n[   64.169977]  ? __pfx_xfrm_policy_lookup_bytype+0x10/0x10\n[   64.169977]  xfrm_lookup_with_ifid+0x3d8/0xb80\n[   64.169977]  ? __pfx_xfrm_lookup_with_ifid+0x10/0x10\n[   64.169977]  ? ip_route_output_key_hash+0xc6/0x110\n[   64.169977]  ? kasan_save_track+0x10/0x30\n[   64.169977]  xfrm_lookup_route+0x18/0xe0\n[   64.169977]  ip4_datagram_release_cb+0x4c9/0x530\n[   64.169977]  ? __pfx_ip4_datagram_release_cb+0x10/0x10\n[   64.169977]  ? do_raw_spin_lock+0x71/0xc0\n[   64.169977]  ? __pfx_do_raw_spin_lock+0x10/0x10\n[   64.169977]  release_sock+0xb0/0x170\n[   64.169977]  udp_connect+0x43/0x50\n[   64.169977]  __sys_connect+0xa6/0x100\n[   64.169977]  ? alloc_fd+0x2e9/0x300\n[   64.169977]  ? __pfx___sys_connect+0x10/0x10\n[   64.169977]  ? preempt_latency\n---truncated---","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-10 13:20:35","updated_at":"2026-08-10 13:20:35"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/d7fc6f351c478586980a521d63b0214d9c055e78","name":"https://git.kernel.org/stable/c/d7fc6f351c478586980a521d63b0214d9c055e78","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9333f4b6f44858fc98eb12bf26b8d2959eb975d5","name":"https://git.kernel.org/stable/c/9333f4b6f44858fc98eb12bf26b8d2959eb975d5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ea528f18231ec0f33317be57f8866913b19aba6e","name":"https://git.kernel.org/stable/c/ea528f18231ec0f33317be57f8866913b19aba6e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68420","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68420","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d1716d5a44c37e5743bf6ea4e5cdbdab37727f27 d7fc6f351c478586980a521d63b0214d9c055e78 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d1716d5a44c37e5743bf6ea4e5cdbdab37727f27 9333f4b6f44858fc98eb12bf26b8d2959eb975d5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d1716d5a44c37e5743bf6ea4e5cdbdab37727f27 ea528f18231ec0f33317be57f8866913b19aba6e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.14","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.14 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.42 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.6 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2-rc4 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d7fc6f351c478586980a521d63b0214d9c055e78","status":"affected","version":"d1716d5a44c37e5743bf6ea4e5cdbdab37727f27","versionType":"git"},{"lessThan":"9333f4b6f44858fc98eb12bf26b8d2959eb975d5","status":"affected","version":"d1716d5a44c37e5743bf6ea4e5cdbdab37727f27","versionType":"git"},{"lessThan":"ea528f18231ec0f33317be57f8866913b19aba6e","status":"affected","version":"d1716d5a44c37e5743bf6ea4e5cdbdab37727f27","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2-rc4","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.42","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.6","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2-rc4","versionStartIncluding":"6.14","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: reject optional IPTFS templates in outbound policies\n\nsyzbot reported a stack-out-of-bounds read in xfrm_state_find()\nwhich flows from xfrm_tmpl_resolve_one().\n\nCommit 3d776e31c841 (\"xfrm: Reject optional tunnel/BEET mode\ntemplates in outbound policies\") disallowed optional tunnel and\nBEET in outbound policies to prevent this. Later when IPTFS\nadded, it was not covered by that fix and can still trigger\nthe out-of-bounds read;\n\nExtend the check to disallow optional IPTFS in outbound policies\nas well. IPTFS should be identical to tunnel mode.\nIN and FWD policies are not affected: xfrm_tmpl_resolve_one()\nis only reachable via the outbound path.\n\nReproducer, before:\n\nip link add dummy0 type dummy\nip link set dummy0 up\nip addr add 10.1.1.1/24 dev dummy0\nip xfrm policy add src 10.1.1.1/32 dst 10.1.1.2/32 dir out tmpl\n  src fc00::dead:1 dst fc00::dead:2 proto esp reqid 1 mode iptfs\n  level use tmpl src fc00::dead:1 dst fc00::dead:2 proto esp reqid\n  2 mode transport\nping -W 1 -c 1 10.1.1.2\nPING 10.1.1.2 (10.1.1.2) 56(84) bytes of data.\n\n[   64.168420] ==================================================================\n[   64.169977] BUG: KASAN: stack-out-of-bounds in __xfrm6_addr_hash+0x11e/0x170\n[   64.169977] Read of size 4 at addr ffff88800e1ffd20 by task ping/2844\n\n[   64.169977] CPU: 2 UID: 0 PID: 2844 Comm: ping Not tainted 7.1.0-rc7-00180-geb23b588430a #98 PREEMPT(full)\n[   64.169977] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   64.169977] Call Trace:\n[   64.169977]  <TASK>\n[   64.169977]  dump_stack_lvl+0x47/0x70\n[   64.169977]  ? __xfrm6_addr_hash+0x11e/0x170\n[   64.169977]  print_report+0x152/0x4b0\n[   64.169977]  ? ksys_mmap_pgoff+0x6d/0xa0\n[   64.169977]  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   64.169977]  ? rcu_read_unlock_sched+0xa/0x20\n[   64.169977]  ? __virt_addr_valid+0x21b/0x230\n[   64.169977]  ? __xfrm6_addr_hash+0x11e/0x170\n[   64.169977]  kasan_report+0xa8/0xd0\n[   64.169977]  ? __xfrm6_addr_hash+0x11e/0x170\n[   64.169977]  __xfrm6_addr_hash+0x11e/0x170\n[   64.169977]  __xfrm_dst_hash+0x24/0xc0\n[   64.169977]  xfrm_state_find+0xa2d/0x2f90\n[   64.169977]  ? __pfx_xfrm_state_find+0x10/0x10\n[   64.169977]  ? __pfx_ftrace_graph_ret_addr+0x10/0x10\n[   64.169977]  ? __pfx_ftrace_graph_ret_addr+0x10/0x10\n[   64.169977]  xfrm_tmpl_resolve_one+0x210/0x570\n[   64.169977]  ? __pfx_xfrm_tmpl_resolve_one+0x10/0x10\n[   64.169977]  ? __pfx_stack_trace_consume_entry+0x10/0x10\n[   64.169977]  ? kernel_text_address+0x5b/0x80\n[   64.169977]  ? __kernel_text_address+0xe/0x30\n[   64.169977]  ? unwind_get_return_address+0x5e/0x90\n[   64.169977]  ? arch_stack_walk+0x8c/0xe0\n[   64.169977]  xfrm_tmpl_resolve+0x130/0x200\n[   64.169977]  ? __pfx_xfrm_tmpl_resolve+0x10/0x10\n[   64.169977]  ? __pfx_xfrm_policy_inexact_lookup_rcu+0x10/0x10\n[   64.169977]  ? __refcount_add_not_zero.constprop.0+0xb2/0x110\n[   64.169977]  ? __pfx___refcount_add_not_zero.constprop.0+0x10/0x10\n[   64.169977]  xfrm_resolve_and_create_bundle+0xd5/0x310\n[   64.169977]  ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10\n[   64.169977]  ? __pfx_xfrm_policy_lookup_bytype+0x10/0x10\n[   64.169977]  ? __pfx_xfrm_policy_lookup_bytype+0x10/0x10\n[   64.169977]  xfrm_lookup_with_ifid+0x3d8/0xb80\n[   64.169977]  ? __pfx_xfrm_lookup_with_ifid+0x10/0x10\n[   64.169977]  ? ip_route_output_key_hash+0xc6/0x110\n[   64.169977]  ? kasan_save_track+0x10/0x30\n[   64.169977]  xfrm_lookup_route+0x18/0xe0\n[   64.169977]  ip4_datagram_release_cb+0x4c9/0x530\n[   64.169977]  ? __pfx_ip4_datagram_release_cb+0x10/0x10\n[   64.169977]  ? do_raw_spin_lock+0x71/0xc0\n[   64.169977]  ? __pfx_do_raw_spin_lock+0x10/0x10\n[   64.169977]  release_sock+0xb0/0x170\n[   64.169977]  udp_connect+0x43/0x50\n[   64.169977]  __sys_connect+0xa6/0x100\n[   64.169977]  ? alloc_fd+0x2e9/0x300\n[   64.169977]  ? __pfx___sys_connect+0x10/0x10\n[   64.169977]  ? preempt_latency\n---truncated---"}],"providerMetadata":{"dateUpdated":"2026-08-10T12:04:40.933Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/d7fc6f351c478586980a521d63b0214d9c055e78"},{"url":"https://git.kernel.org/stable/c/9333f4b6f44858fc98eb12bf26b8d2959eb975d5"},{"url":"https://git.kernel.org/stable/c/ea528f18231ec0f33317be57f8866913b19aba6e"}],"title":"xfrm: reject optional IPTFS templates in outbound policies","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-68420","datePublished":"2026-08-10T12:04:40.933Z","dateReserved":"2026-07-30T09:28:09.392Z","dateUpdated":"2026-08-10T12:04:40.933Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-10 13:20:35","lastModifiedDate":"2026-08-10 13:20:35","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"68420","Ordinal":"1","Title":"xfrm: reject optional IPTFS templates in outbound policies","CVE":"CVE-2026-68420","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"68420","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: reject optional IPTFS templates in outbound policies\n\nsyzbot reported a stack-out-of-bounds read in xfrm_state_find()\nwhich flows from xfrm_tmpl_resolve_one().\n\nCommit 3d776e31c841 (\"xfrm: Reject optional tunnel/BEET mode\ntemplates in outbound policies\") disallowed optional tunnel and\nBEET in outbound policies to prevent this. Later when IPTFS\nadded, it was not covered by that fix and can still trigger\nthe out-of-bounds read;\n\nExtend the check to disallow optional IPTFS in outbound policies\nas well. IPTFS should be identical to tunnel mode.\nIN and FWD policies are not affected: xfrm_tmpl_resolve_one()\nis only reachable via the outbound path.\n\nReproducer, before:\n\nip link add dummy0 type dummy\nip link set dummy0 up\nip addr add 10.1.1.1/24 dev dummy0\nip xfrm policy add src 10.1.1.1/32 dst 10.1.1.2/32 dir out tmpl\n  src fc00::dead:1 dst fc00::dead:2 proto esp reqid 1 mode iptfs\n  level use tmpl src fc00::dead:1 dst fc00::dead:2 proto esp reqid\n  2 mode transport\nping -W 1 -c 1 10.1.1.2\nPING 10.1.1.2 (10.1.1.2) 56(84) bytes of data.\n\n[   64.168420] ==================================================================\n[   64.169977] BUG: KASAN: stack-out-of-bounds in __xfrm6_addr_hash+0x11e/0x170\n[   64.169977] Read of size 4 at addr ffff88800e1ffd20 by task ping/2844\n\n[   64.169977] CPU: 2 UID: 0 PID: 2844 Comm: ping Not tainted 7.1.0-rc7-00180-geb23b588430a #98 PREEMPT(full)\n[   64.169977] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   64.169977] Call Trace:\n[   64.169977]  <TASK>\n[   64.169977]  dump_stack_lvl+0x47/0x70\n[   64.169977]  ? __xfrm6_addr_hash+0x11e/0x170\n[   64.169977]  print_report+0x152/0x4b0\n[   64.169977]  ? ksys_mmap_pgoff+0x6d/0xa0\n[   64.169977]  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   64.169977]  ? rcu_read_unlock_sched+0xa/0x20\n[   64.169977]  ? __virt_addr_valid+0x21b/0x230\n[   64.169977]  ? __xfrm6_addr_hash+0x11e/0x170\n[   64.169977]  kasan_report+0xa8/0xd0\n[   64.169977]  ? __xfrm6_addr_hash+0x11e/0x170\n[   64.169977]  __xfrm6_addr_hash+0x11e/0x170\n[   64.169977]  __xfrm_dst_hash+0x24/0xc0\n[   64.169977]  xfrm_state_find+0xa2d/0x2f90\n[   64.169977]  ? __pfx_xfrm_state_find+0x10/0x10\n[   64.169977]  ? __pfx_ftrace_graph_ret_addr+0x10/0x10\n[   64.169977]  ? __pfx_ftrace_graph_ret_addr+0x10/0x10\n[   64.169977]  xfrm_tmpl_resolve_one+0x210/0x570\n[   64.169977]  ? __pfx_xfrm_tmpl_resolve_one+0x10/0x10\n[   64.169977]  ? __pfx_stack_trace_consume_entry+0x10/0x10\n[   64.169977]  ? kernel_text_address+0x5b/0x80\n[   64.169977]  ? __kernel_text_address+0xe/0x30\n[   64.169977]  ? unwind_get_return_address+0x5e/0x90\n[   64.169977]  ? arch_stack_walk+0x8c/0xe0\n[   64.169977]  xfrm_tmpl_resolve+0x130/0x200\n[   64.169977]  ? __pfx_xfrm_tmpl_resolve+0x10/0x10\n[   64.169977]  ? __pfx_xfrm_policy_inexact_lookup_rcu+0x10/0x10\n[   64.169977]  ? __refcount_add_not_zero.constprop.0+0xb2/0x110\n[   64.169977]  ? __pfx___refcount_add_not_zero.constprop.0+0x10/0x10\n[   64.169977]  xfrm_resolve_and_create_bundle+0xd5/0x310\n[   64.169977]  ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10\n[   64.169977]  ? __pfx_xfrm_policy_lookup_bytype+0x10/0x10\n[   64.169977]  ? __pfx_xfrm_policy_lookup_bytype+0x10/0x10\n[   64.169977]  xfrm_lookup_with_ifid+0x3d8/0xb80\n[   64.169977]  ? __pfx_xfrm_lookup_with_ifid+0x10/0x10\n[   64.169977]  ? ip_route_output_key_hash+0xc6/0x110\n[   64.169977]  ? kasan_save_track+0x10/0x30\n[   64.169977]  xfrm_lookup_route+0x18/0xe0\n[   64.169977]  ip4_datagram_release_cb+0x4c9/0x530\n[   64.169977]  ? __pfx_ip4_datagram_release_cb+0x10/0x10\n[   64.169977]  ? do_raw_spin_lock+0x71/0xc0\n[   64.169977]  ? __pfx_do_raw_spin_lock+0x10/0x10\n[   64.169977]  release_sock+0xb0/0x170\n[   64.169977]  udp_connect+0x43/0x50\n[   64.169977]  __sys_connect+0xa6/0x100\n[   64.169977]  ? alloc_fd+0x2e9/0x300\n[   64.169977]  ? __pfx___sys_connect+0x10/0x10\n[   64.169977]  ? preempt_latency\n---truncated---","Type":"Description","Title":"xfrm: reject optional IPTFS templates in outbound policies"}]}}}