Executive brief
The Linux kernel's ESP (Encapsulating Security Payload) subsystem improperly manages page references when processing network packets with managed memory fragments from zerocopy I/O operations (such as io_uring SEND_ZC). An attacker sending specially crafted packets can trigger an underflow in page reference counts, potentially freeing memory pages that are still in active use, causing system instability or enabling further exploitation.
Technical details
The vulnerability exists in the esp_ssg_unref() function in both IPv4 and IPv6 ESP implementations (net/ipv4/esp4.c and net/ipv6/esp6.c). The function incorrectly releases page references held by scatterlist entries after AEAD operations, without checking whether those pages are managed frags owned by a zerocopy user buffer. Managed frags (flagged with SKBFL_MANAGED_FRAG_REFS) are owned by io_uring or similar mechanisms and the kernel should not decrement their reference counts. The bug occurs when esp_ssg_unref() calls skb_page_unref() on managed-frag pages, dropping a reference the socket buffer never acquired, causing potential page reference underflow and use-after-free. A fix adds a skb_zcopy_managed() guard to skip unref operations on managed-frag skbs, consistent with skb_release_data() behavior. The vulnerability affects systems using ESP with zerocopy I/O, requires network-accessible ESP traffic, and has been patched in recent kernel stable branches.
Affected products
- Linux Linux Kernel Multiple versions (affects ESP subsystem in IPv4 and IPv6)
Timeline
- 2026-09-17: disclosed: CVE-2026-93105 published on NVD
- 2026-07-13: patched: Fix committed upstream (commit 21697720ff43b8dfa25b8e8d9ca7f56f4597fc80)