Executive brief
A memory management issue was identified in the Linux kernel's IP Payload Compression (IPComp) component, which is used to reduce the size of IP packets. Under certain error conditions during data compression, the system would fail to release memory pages that were previously allocated. Over time, this could lead to a gradual depletion of system memory, potentially impacting the performance or stability of the server.
Technical details
A memory leak exists in net/xfrm/xfrm_ipcomp.c within the ipcomp_post_acomp function. The vulnerability is caused by an incorrect placement of the 'out_free_req' label, which resulted in the destination scatter-gather (SG) list pages not being freed when an asynchronous compression error occurred. An attacker could potentially trigger this error path to cause a kernel memory leak. The fix involves reordering the error handling logic to ensure __free_page is called for the allocated destination pages regardless of whether the operation succeeded or failed. Patches have been released for various stable kernel branches including 6.18.x and 7.0.x.
Affected products
- Linux Linux Kernel 6.15 to 6.18.35, 7.0.12, 7.1
Timeline
- 2026-05-06: other: Initial patch authored
- 2026-06-24: disclosed: CVE published