by Kastro
Paper/Archive/CVE-2026-63912

CVE-2026-63912

Linux Linux — xfrm: esp: restore combined single-frag length gate

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.6.536 × 2010.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in esp_output_head() before esp_output_tail() allocates the destination page frag. The head-side gate currently checks skb->data_len and tailen separately, but the tail code allocates a single destination frag from the combined post-trailer skb->data_len. Reject the page-frag fast path when the combined aligned length exceeds a page. Otherwise skb_page_frag_refill() may fall back to a single page while the destination sg still spans the combined skb->data_len. Restore this combined-length page gate for both IPv4 and IPv6.

Affected

ProductAffectedFixed inSource
Linuxc075c3ea031757f8ea2d34567565b61a868c08d5 – < 566295735530ee513326049b0540f32ec050bf2e566295735530ee513326049b0540f32ec050bf2eCNA
Linuxa583f2f3c8788bffd7fd7baeb76bd6d80543d7ea – < 5d7ab86e2b6bc23054616bf6ac562013bf60af8c5d7ab86e2b6bc23054616bf6ac562013bf60af8cCNA
Linux5bd8baab087dff657e05387aee802e70304cc813 – < 36519e3d941fc99d3b52c134dbaf311f987a470836519e3d941fc99d3b52c134dbaf311f987a4708CNA
Linux5bd8baab087dff657e05387aee802e70304cc813 – < 322e48187e0245ab2fff6fec2220b0cae677dbec322e48187e0245ab2fff6fec2220b0cae677dbecCNA
Linux5bd8baab087dff657e05387aee802e70304cc813 – < b84091ceddc9f133229dceab3ccc930bf27f9cbab84091ceddc9f133229dceab3ccc930bf27f9cbaCNA
Linux5bd8baab087dff657e05387aee802e70304cc813 – < c093468aea8277f77272a4f199b2e15e19cabb59c093468aea8277f77272a4f199b2e15e19cabb59CNA
Linux5bd8baab087dff657e05387aee802e70304cc813 – < 65f3b3fc2347b89fe21db1e92c7681368415f09565f3b3fc2347b89fe21db1e92c7681368415f095CNA
Linux5bd8baab087dff657e05387aee802e70304cc813 – < dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40CNA
Linux2c66b0c95bb0aa7652ba1eba293d0d5993b35a38–CNA
Linuxef6f83df1209a7d9bd1c605a62457d4c00f9179e–CNA
Linux3defefd22ad5fbbe639b6157fb7e6311b2bf333d–CNA
Linuxb657030870bb5351c5b1e84d4e9f186da6ca0496–CNA

Scores by source

Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgit.kernel.org/stable/c/566295735530ee513326049b0540f32ec050bf2erefgit.kernel.org/stable/c/5d7ab86e2b6bc23054616bf6ac562013bf60af8crefgit.kernel.org/stable/c/36519e3d941fc99d3b52c134dbaf311f987a4708refgit.kernel.org/stable/c/322e48187e0245ab2fff6fec2220b0cae677dbecrefgit.kernel.org/stable/c/b84091ceddc9f133229dceab3ccc930bf27f9cbarefgit.kernel.org/stable/c/c093468aea8277f77272a4f199b2e15e19cabb59refgit.kernel.org/stable/c/65f3b3fc2347b89fe21db1e92c7681368415f095refgit.kernel.org/stable/c/dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40