Executive brief
A vulnerability was identified in the Linux kernel's networking component (IP-TFS) that could lead to data corruption or security bypasses during encrypted communications. The system fails to correctly track when data fragments are shared between different parts of the memory, which can cause the encryption process to incorrectly modify data that should remain read-only. This could potentially impact the integrity of network traffic or the stability of the operating system.
Technical details
A vulnerability exists in the xfrm_iptfs component of the Linux kernel where the iptfs_consume_frags() function fails to propagate the SKBFL_SHARED_FRAG flag when transferring paged fragments between socket buffers (skbs). This flag is critical for the Encapsulating Security Payload (ESP) protocol to determine if in-place encryption is safe. When fragments backed by read-only page-cache pages are merged without this marker, the kernel may attempt to encrypt data in-place that is actually shared, leading to memory corruption or incorrect ciphertext. This is a logic error in memory management within the networking stack, reachable via network traffic utilizing IP-TFS. Patches have been released for various stable branches including 6.18.36 and 7.0.13.
Affected products
- Linux Linux Kernel 6.14 to 7.1
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory