Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-63912

xfrm: esp: restore combined single-frag length gate

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in esp_output_head() before esp_output_tail() allocates the destination page frag. The head-side gate currently checks skb->data_len and tailen separately, but the tail code allocates a single destination frag from the combined post-trailer skb->data_len. Reject the page-frag fast path when the combined aligned length exceeds a page. Otherwise skb_page_frag_refill() may fall back to a single page while the destination sg still spans the combined skb->data_len. Restore this combined-length page gate for both IPv4 and IPv6.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • c075c3ea031757f8ea2d34567565b61a868c08d5 to < 566295735530ee513326049b0540f32ec050bf2eaffected
  • a583f2f3c8788bffd7fd7baeb76bd6d80543d7ea to < 5d7ab86e2b6bc23054616bf6ac562013bf60af8caffected
  • 5bd8baab087dff657e05387aee802e70304cc813 to < 36519e3d941fc99d3b52c134dbaf311f987a4708affected
  • 5bd8baab087dff657e05387aee802e70304cc813 to < 322e48187e0245ab2fff6fec2220b0cae677dbecaffected
  • 5bd8baab087dff657e05387aee802e70304cc813 to < b84091ceddc9f133229dceab3ccc930bf27f9cbaaffected
  • 5bd8baab087dff657e05387aee802e70304cc813 to < c093468aea8277f77272a4f199b2e15e19cabb59affected
  • 5bd8baab087dff657e05387aee802e70304cc813 to < 65f3b3fc2347b89fe21db1e92c7681368415f095affected
  • 5bd8baab087dff657e05387aee802e70304cc813 to < dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40affected
  • 2c66b0c95bb0aa7652ba1eba293d0d5993b35a38affected
  • ef6f83df1209a7d9bd1c605a62457d4c00f9179eaffected
  • 3defefd22ad5fbbe639b6157fb7e6311b2bf333daffected
  • b657030870bb5351c5b1e84d4e9f186da6ca0496affected
  • 5.10.113 to < 5.10.259affected
  • 5.15.36 to < 5.15.210affected
  • 4.14.288 to < 4.15affected
  • 4.19.252 to < 4.20affected
  • 5.4.205 to < 5.5affected
  • 5.17.5 to < 5.18affected

Linux Linux

Default version status: affected

  • 5.18affected
  • 0 to < 5.18unaffected
  • 5.10.259 to ≤ 5.10.*unaffected
  • 5.15.210 to ≤ 5.15.*unaffected
  • 6.1.176 to ≤ 6.1.*unaffected
  • 6.6.143 to ≤ 6.6.*unaffected
  • 6.12.93 to ≤ 6.12.*unaffected
  • 6.18.35 to ≤ 6.18.*unaffected
  • 7.0.12 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References