CVE-2026-63912: xfrm: esp: restore combined single-frag length gate

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-19 · updated 2026-10-30
Weakness: CWE-125

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in esp_output_head() before esp_output_tail() allocates the destination page frag. The head-side gate currently checks skb->data_len and tailen separately, but the tail code allocates a single destination frag from the combined post-trailer skb->data_len. Reject the page-frag fast path when the combined aligned length exceeds a page. Otherwise skb_page_frag_refill() may fall back to a single page while the destination sg still spans the combined skb->data_len. Restore this combined-length page gate for both IPv4 and IPv6.

Affected products

Linux kernel: from 4.14.288 before 4.15; from 4.19.252 before 4.20; from 5.4.205 before 5.5; from 5.10.113 before 5.10.259; from 5.15.36 before 5.15.210; from 5.17.5 before 5.18 — fixed in 4.15, 4.20, 5.5, 5.10.259, 5.15.210, 5.18
Linux kernel: from 5.10.113 before 5.10.259; from 5.15.36 before 5.15.210; from 4.14.288 before 4.15; from 4.19.252 before 4.20; from 5.4.205 before 5.5; from 5.17.5 before 5.18 — fixed in 4.15, 4.20, 5.10.259, 5.15.210, 5.18, 5.5

How to fix

Upgrade to a fixed version: Linux kernel 4.15, 4.20, 5.5, 5.10.259; Linux kernel 4.15, 4.20, 5.10.259, 5.15.210. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-63912 or the next vulnerability affects your stack