Executive brief
The Linux kernel's ESP-over-TCP implementation (used for encrypted VPN traffic) had a bug in how it tracked memory usage when partially sending data. When data transmission was incomplete, the kernel failed to properly account for freed memory, potentially causing memory exhaustion or other stability issues.
Technical details
The vulnerability exists in the espintcp (Encapsulating Security Payload over TCP, RFC 8229) implementation in net/xfrm/espintcp.c. The vulnerable code manually handled memory accounting and offset management when sending socket messages (skmsg), which led to inconsistencies when TCP transmission did not complete in a single send operation. An attacker could trigger incomplete sends by controlling network conditions on a system using ESP-over-TCP, causing the kernel to fail to uncharge memory properly and leading to denial of service. The fix replaces the manual accounting logic with sk_msg_free_partial(), which ensures consistent state. No authentication is required; any network-reachable system using ESP-over-TCP is potentially affected.
Affected products
- Linux Linux kernel multiple versions (see kernel tree references for full range)
Timeline
- 2026-06-17: disclosed
- 2026-06-17: patched