Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem, specifically within the IPsec ESP (Encapsulating Security Payload) implementation. This component is responsible for encrypting and securing network traffic. An issue in how the system manages memory buffers during high-speed data processing could potentially lead to system instability or memory corruption, impacting the reliability and security of encrypted communications.
Technical details
A vulnerability exists in the Linux kernel's XFRM ESP implementation (net/ipv4/esp4.c and net/ipv6/esp6.c) due to an improper length check in the 'out-of-place' fast path. The code previously checked the data length and trailer length separately against the PAGE_SIZE limit. However, because the tail code (esp_output_tail) allocates a single destination fragment based on the combined length, a packet where the individual components are under PAGE_SIZE but the combined length exceeds it could cause skb_page_frag_refill() to misallocate memory. This results in the destination scatterlist spanning more data than the allocated page fragment, leading to potential memory corruption. The fix restores a combined-length gate to ensure the fast path is rejected if the total aligned length exceeds a single page.
Affected products
- Linux Linux 5.10.y, 5.15.y, 6.1.y, 6.6.y, 6.9.y, 6.10.y
Timeline
- 2026-07-19: advisory
- 2026-06-19: patched
References
- https://git.kernel.org/stable/c/322e48187e0245ab2fff6fec2220b0cae677dbec
- https://git.kernel.org/stable/c/36519e3d941fc99d3b52c134dbaf311f987a4708
- https://git.kernel.org/stable/c/566295735530ee513326049b0540f32ec050bf2e
- https://git.kernel.org/stable/c/5d7ab86e2b6bc23054616bf6ac562013bf60af8c
- https://git.kernel.org/stable/c/65f3b3fc2347b89fe21db1e92c7681368415f095
- https://git.kernel.org/stable/c/b84091ceddc9f133229dceab3ccc930bf27f9cba
- https://git.kernel.org/stable/c/c093468aea8277f77272a4f199b2e15e19cabb59