Executive brief
A vulnerability in the Linux kernel's networking component could allow a local attacker to gain elevated privileges. The issue occurs when the system processes encrypted network traffic (IPsec ESP) using a specific memory-sharing optimization. By manipulating how data is shared between the operating system and applications, an attacker could potentially overwrite sensitive kernel memory, leading to a full system takeover.
Technical details
A vulnerability exists in the Linux kernel's XFRM ESP (Encapsulating Security Payload) implementation due to improper handling of shared socket buffer (skb) fragments. When using MSG_SPLICE_PAGES, pages from a pipe can be attached directly to an skb. While TCP correctly marks these as shared, the IPv4/IPv6 datagram paths (UDP) failed to set the SKBFL_SHARED_FRAG flag. This causes the ESP input path to incorrectly assume it can decrypt data in-place without performing a Copy-on-Write (COW) operation. A local attacker can exploit this 'write-what-where' condition (CWE-123) to overwrite data in shared pages, potentially leading to local privilege escalation. Patches have been released for various stable kernel branches.
Affected products
- Linux Linux kernel 4.11 to 5.10.255, 5.12 to 5.15.205, 5.16 to 6.1.171, 6.2 to 6.6.138, 6.7 to 6.12.87, 6.13 to 6.18.28
Timeline
- 2026-05-04: other: Patch authored
- 2026-05-08: advisory: Initial disclosure and publication
- 2026-05-08: patched: Commits pushed to stable trees
References
- https://git.kernel.org/stable/c/50ed1e7873100f77abad20fd31c51029bc49cd03
- https://git.kernel.org/stable/c/52646cbd00e765a6db9c3afe9535f26218276034
- https://git.kernel.org/stable/c/5d55c7336f8032d434adcc5fab987ccc93a44aec
- https://git.kernel.org/stable/c/71a1d9d985d26716f74d21f18ee8cac821b06e97
- https://git.kernel.org/stable/c/8253aab4659ca16116b522203c2a6b18dccacea7
- https://git.kernel.org/stable/c/a6cb440f274a22456ef3e86b457344f1678f38f9
- https://git.kernel.org/stable/c/ab8b995323e5237041472d07e5055f5f7dcdf15b