Executive brief
A vulnerability in the Linux kernel's networking component could allow a memory leak when processing encrypted network traffic (IPsec ESP). This occurs when the system fails to properly release memory references during specific error conditions. Over time, this could lead to increased memory consumption and potential system instability or service degradation.
Technical details
A reference leak exists in the Linux kernel's ESP implementation (both esp4 and esp6) within the esp_output_tail() function. When the kernel processes outbound ESP packets and 'inplace' processing is disabled, it replaces old socket buffer (skb) page fragments with new ones. If a subsequent call to skb_to_sgvec() fails, the error handling path (error_free) fails to release the references to the original page fragments stored in the source scatterlist. This occurs because the aead_request_set_crypt() function has not yet initialized the request fields that the standard cleanup routine (esp_ssg_unref) relies on. The fix introduces a parameter to force unreferencing of the source scatterlist during these specific failure states. This vulnerability could be triggered by network traffic that causes skb_to_sgvec to fail, leading to a kernel memory leak.
Affected products
- Linux Linux Kernel 4.11 to 7.0.13
Timeline
- 2026-05-20: other: Initial patch authored
- 2026-07-19: disclosed: CVE published