Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to crash the system or potentially execute unauthorized commands. The issue occurs when processing specific types of encrypted network traffic (IPsec ESP) under unusual configuration settings. By manipulating technical parameters like the Maximum Transmission Unit (MTU) and encryption keys, an attacker can trigger a massive memory corruption event, leading to a complete system failure.
Technical details
An integer underflow vulnerability exists in the xfrm_state_mtu() function within the Linux kernel's XFRM (IPsec) subsystem. When calculating the MTU for an ESP tunnel, the function performs unsigned arithmetic that can underflow if the overhead (header length, authentication size, and network adjustment) exceeds the provided MTU. This underflowed value is subsequently treated as a signed integer in esp_output(), resulting in a negative 'tfclen' value. When this negative value is passed to memset() as a size_t, it is sign-extended to a massive positive value, causing an out-of-bounds write of zeroes (approximately 16 exabytes). A local user can trigger this by installing a specific IPv4 ESP tunnel SA with a large authentication key and a small interface MTU. The fix introduces underflow checks in xfrm_state_mtu() to return an error state.
Affected products
- Linux Linux Kernel c5c252389374 to 742b04d0550b
Timeline
- 2026-05-13: other: Patch authored
- 2026-06-19: patched: Patch committed to stable tree
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1021d2877b689a648b27815c854557a917122e93
- https://git.kernel.org/stable/c/2a41b1b31c61c52b972278ce1732a1443f5e89ed
- https://git.kernel.org/stable/c/3db50ceeacb52806d8fe86fb1dfe944df0b9f789
- https://git.kernel.org/stable/c/742b04d0550b0ec89dcbc99537ec88653bd1ad90
- https://git.kernel.org/stable/c/8014f70c4e6e5ab101ae3860a614e65e988372e3
- https://git.kernel.org/stable/c/820e501be8aee4b365d218d83227b314309c5fda
- https://git.kernel.org/stable/c/82ac903e0b519849647657b8c48d21237ada06a2