Executive brief
A vulnerability was identified in the Linux kernel's networking component responsible for handling encrypted traffic over TCP (IPsec/ESP). Under certain conditions, the system could incorrectly reuse memory while a previous data transmission was still in progress. This could lead to system instability, crashes, or potential unauthorized access to small amounts of kernel memory.
Technical details
A memory safety vulnerability exists in net/xfrm/espintcp.c within the Linux kernel. The espintcp_sendmsg() function fails to properly check if a previous partial transmission (stored in ctx->partial) is still pending before reinitializing the message state. For blocking callers, espintcp_push_msgs() may return success while a send is still pending; subsequent reuse of the live partial-send state can leave a stale offset attached to a new sk_msg. This root cause leads to an out-of-bounds read in the send path. The issue has been resolved by ensuring the send message is not rebuilt if ctx->partial is still in progress.
Affected products
- Linux Linux Kernel e27cca96cd68 to 6564e9c7af7e1dc7bfe7f3093b728abe484d7630
Timeline
- 2026-06-03: other: Vulnerability fixed in source code
- 2026-06-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1777ceac4bea5e568a5ad44b7f9bb219c1db21b6
- https://git.kernel.org/stable/c/37487d55bf3300e3d2c1368da5c2bd3e3834ea4f
- https://git.kernel.org/stable/c/6564e9c7af7e1dc7bfe7f3093b728abe484d7630
- https://git.kernel.org/stable/c/8c6c691bf062dc0753a139a4ab8cb92a70fcf8f3
- https://git.kernel.org/stable/c/aa82a078f70f7ff88ba7d1017134e79d1ac140f2
- https://git.kernel.org/stable/c/ba21439302db9a82fe4edbed1e38a97271529421
- https://git.kernel.org/stable/c/c381039ade2e161ab08c0eda73c4f8b9a7115928