xfrm: esp: restore combined single-frag length gate

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2026-63912
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-07-19 16:17:09 UTC
Updated2026-07-20 15:16:55 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in esp_output_head() before esp_output_tail() allocates the destination page frag. The head-side gate currently checks skb->data_len and tailen separately, but the tail code allocates a single destination frag from the combined post-trailer skb->data_len. Reject the page-frag fast path when the combined aligned length exceeds a page. Otherwise skb_page_frag_refill() may fall back to a single page while the destination sg still spans the combined skb->data_len. Restore this combined-length page gate for both IPv4 and IPv6.

Risk And Classification

Primary CVSS: v3.1 9.8 CRITICAL from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.002100000 probability, percentile 0.113650000 (date 2026-07-20)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary9.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED9.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected c075c3ea031757f8ea2d34567565b61a868c08d5 566295735530ee513326049b0540f32ec050bf2e git Not specified
CNA Linux Linux affected a583f2f3c8788bffd7fd7baeb76bd6d80543d7ea 5d7ab86e2b6bc23054616bf6ac562013bf60af8c git Not specified
CNA Linux Linux affected 5bd8baab087dff657e05387aee802e70304cc813 36519e3d941fc99d3b52c134dbaf311f987a4708 git Not specified
CNA Linux Linux affected 5bd8baab087dff657e05387aee802e70304cc813 322e48187e0245ab2fff6fec2220b0cae677dbec git Not specified
CNA Linux Linux affected 5bd8baab087dff657e05387aee802e70304cc813 b84091ceddc9f133229dceab3ccc930bf27f9cba git Not specified
CNA Linux Linux affected 5bd8baab087dff657e05387aee802e70304cc813 c093468aea8277f77272a4f199b2e15e19cabb59 git Not specified
CNA Linux Linux affected 5bd8baab087dff657e05387aee802e70304cc813 65f3b3fc2347b89fe21db1e92c7681368415f095 git Not specified
CNA Linux Linux affected 5bd8baab087dff657e05387aee802e70304cc813 dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40 git Not specified
CNA Linux Linux affected 2c66b0c95bb0aa7652ba1eba293d0d5993b35a38 git Not specified
CNA Linux Linux affected ef6f83df1209a7d9bd1c605a62457d4c00f9179e git Not specified
CNA Linux Linux affected 3defefd22ad5fbbe639b6157fb7e6311b2bf333d git Not specified
CNA Linux Linux affected b657030870bb5351c5b1e84d4e9f186da6ca0496 git Not specified
CNA Linux Linux affected 5.10.113 5.10.259 semver Not specified
CNA Linux Linux affected 5.15.36 5.15.210 semver Not specified
CNA Linux Linux affected 4.14.288 4.15 semver Not specified
CNA Linux Linux affected 4.19.252 4.20 semver Not specified
CNA Linux Linux affected 5.4.205 5.5 semver Not specified
CNA Linux Linux affected 5.17.5 5.18 semver Not specified
CNA Linux Linux affected 5.18 Not specified
CNA Linux Linux unaffected 5.18 semver Not specified
CNA Linux Linux unaffected 5.10.259 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.210 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.176 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.143 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.93 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.35 6.18.* semver Not specified
CNA Linux Linux unaffected 7.0.12 7.0.* semver Not specified
CNA Linux Linux unaffected 7.1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/36519e3d941fc99d3b52c134dbaf311f987a4708 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c093468aea8277f77272a4f199b2e15e19cabb59 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5d7ab86e2b6bc23054616bf6ac562013bf60af8c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/65f3b3fc2347b89fe21db1e92c7681368415f095 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/322e48187e0245ab2fff6fec2220b0cae677dbec 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/566295735530ee513326049b0540f32ec050bf2e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b84091ceddc9f133229dceab3ccc930bf27f9cba 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report