CVE-2026-63912 - Vulnerability Details

- xfrm: esp: restore combined single-frag length gate

Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: esp: restore combined single-frag length gate

The ESP out-of-place fast path appends the trailer in esp_output_head()
before esp_output_tail() allocates the destination page frag. The
head-side gate currently checks skb->data_len and tailen separately, but
the tail code allocates a single destination frag from the combined
post-trailer skb->data_len.

Reject the page-frag fast path when the combined aligned length exceeds a
page. Otherwise skb_page_frag_refill() may fall back to a single page while
the destination sg still spans the combined skb->data_len.

Restore this combined-length page gate for both IPv4 and IPv6.

Published: 2026-07-19

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw resides in the Linux kernel’s ESP fast‑path handling where the code does not verify that the combined length of the packet trailer and payload stays within a single memory page. A crafted ESP packet can trigger a buffer overrun, corrupting kernel memory. Depending on the context, this corruption could allow an attacker to gain elevated privileges or cause a denial of service by crashing the kernel.

Affected Systems

Linux kernel configurations that use the ESP fast‑path are potentially affected. The CVE does not specify particular releases, so any kernel version that has not applied the patch restoring the length gate remains at risk.

Risk and Exploitability

The vulnerability scores a CVSS of 9.8 and has an EPSS of less than 1 %. It is not listed in the CISA KEV catalog. The likely attack vector is remote and requires the ability to send crafted ESP packets to the target. Successful exploitation could lead to kernel memory corruption, raising the possibility of privilege escalation or a system crash.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c075c3ea031757f8ea2d34567565b61a868c08d5`	affected	< 566295735530ee513326049b0540f32ec050bf2e
`a583f2f3c8788bffd7fd7baeb76bd6d80543d7ea`	affected	< 5d7ab86e2b6bc23054616bf6ac562013bf60af8c
`5bd8baab087dff657e05387aee802e70304cc813`	affected	< 36519e3d941fc99d3b52c134dbaf311f987a4708
`5bd8baab087dff657e05387aee802e70304cc813`	affected	< 322e48187e0245ab2fff6fec2220b0cae677dbec
`5bd8baab087dff657e05387aee802e70304cc813`	affected	< b84091ceddc9f133229dceab3ccc930bf27f9cba
`5bd8baab087dff657e05387aee802e70304cc813`	affected	< c093468aea8277f77272a4f199b2e15e19cabb59
`5bd8baab087dff657e05387aee802e70304cc813`	affected	< 65f3b3fc2347b89fe21db1e92c7681368415f095
`5bd8baab087dff657e05387aee802e70304cc813`	affected	< dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40
`2c66b0c95bb0aa7652ba1eba293d0d5993b35a38`	affected	—
`ef6f83df1209a7d9bd1c605a62457d4c00f9179e`	affected	—
`3defefd22ad5fbbe639b6157fb7e6311b2bf333d`	affected	—
`b657030870bb5351c5b1e84d4e9f186da6ca0496`	affected	—
`5.10.113`	affected	< 5.10.259
`5.15.36`	affected	< 5.15.210
`4.14.288`	affected	< 4.15
`4.19.252`	affected	< 4.20
`5.4.205`	affected	< 5.5
`5.17.5`	affected	< 5.18

Linux

affected

Version	Status	Constraints
`5.18`	affected	—
`0`	unaffected	< 5.18
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c075c3ea031757f8ea2d34567565b61a868c08d5,566295735530ee513326049b0540f32ec050bf2e)`	affected	code_commit	—
`[a583f2f3c8788bffd7fd7baeb76bd6d80543d7ea,5d7ab86e2b6bc23054616bf6ac562013bf60af8c)`	affected	code_commit	—
`[5bd8baab087dff657e05387aee802e70304cc813,36519e3d941fc99d3b52c134dbaf311f987a4708)`	affected	code_commit	—
`[5bd8baab087dff657e05387aee802e70304cc813,322e48187e0245ab2fff6fec2220b0cae677dbec)`	affected	code_commit	—
`[5bd8baab087dff657e05387aee802e70304cc813,b84091ceddc9f133229dceab3ccc930bf27f9cba)`	affected	code_commit	—
`[5bd8baab087dff657e05387aee802e70304cc813,c093468aea8277f77272a4f199b2e15e19cabb59)`	affected	code_commit	—
`[5bd8baab087dff657e05387aee802e70304cc813,65f3b3fc2347b89fe21db1e92c7681368415f095)`	affected	code_commit	—
`[5bd8baab087dff657e05387aee802e70304cc813,dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40)`	affected	code_commit	—
`2c66b0c95bb0aa7652ba1eba293b35a38`	affected	code_commit	—
`ef6f83df1209a7d9bd1c605a62457d4c00f9179e`	affected	code_commit	—
`3defefd22ad5fbbe639b6157fb7e6311b2bf333d`	affected	code_commit	—
`b657030870bb5351c5b1e84d4e9f186da6ca0496`	affected	code_commit	—
`[5.10.113,5.10.259)`	affected	semver	—
`[5.15.36,5.15.210)`	affected	semver	—
`[4.14.288,4.15)`	affected	semver	—
`[4.19.252,4.20)`	affected	semver	—
`[5.4.205,5.5)`	affected	semver	—
`[5.17.5,5.18)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.18`	affected	semver	—
`[0,5.18)`	unaffected	semver	—
`[5.10.259,5.11.0)`	unaffected	semver	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.93,6.13.0)`	unaffected	semver	—
`[6.18.35,6.19.0)`	unaffected	semver	—
`[7.0.12,7.1.0)`	unaffected	semver	—
`[7.1,*)`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the updated kernel that reinstates the combined‑length gate for ESP packet processing, addressing the memory allocation flaw identified by CWE‑125 and CWE‑770.
Filter or rate‑limit inbound ESP traffic using firewall rules to reduce exposure to malicious packets that could trigger the flaw.
Monitor system logs and kernel alerts for signs of ESP‑related anomalies and enforce network segmentation to isolate untrusted networks.

Generated by OpenCVE AI on October 20, 2026 at 08:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8781-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8817-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8818-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8818-2	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8842-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8818-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8818-4	Linux kernel vulnerabilities
Ubuntu USN	USN-8849-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8817-3	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8818-5	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8871-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8906-1	Linux kernel (IBM) vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00714.

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/322e48187e0245ab2fff6fec2220b0cae677dbec
https://git.kernel.org/stable/c/36519e3d941fc99d3b52c134dbaf311f987a4708
https://git.kernel.org/stable/c/566295735530ee513326049b0540f32ec050bf2e
https://git.kernel.org/stable/c/5d7ab86e2b6bc23054616bf6ac562013bf60af8c
https://git.kernel.org/stable/c/65f3b3fc2347b89fe21db1e92c7681368415f095
https://git.kernel.org/stable/c/b84091ceddc9f133229dceab3ccc930bf27f9cba
https://git.kernel.org/stable/c/c093468aea8277f77272a4f199b2e15e19cabb59
https://git.kernel.org/stable/c/dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40
https://lore.kernel.org/linux-cve-announce/2026071946-CVE-2026-63912-a43c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63912
https://www.cve.org/CVERecord?id=CVE-2026-63912

History

Tue, 20 Oct 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 19 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125

Sun, 26 Jul 2026 08:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119

Wed, 22 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-770
References		https://lore.kernel.org/linux-cve-announce/2026071946-CVE-2026-63912-a43c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63912 https://www.cve.org/CVERecord?id=CVE-2026-63912
Metrics	threat_severity `None`	threat_severity `Moderate`

Tue, 21 Jul 2026 23:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in esp_output_head() before esp_output_tail() allocates the destination page frag. The head-side gate currently checks skb->data_len and tailen separately, but the tail code allocates a single destination frag from the combined post-trailer skb->data_len. Reject the page-frag fast path when the combined aligned length exceeds a page. Otherwise skb_page_frag_refill() may fall back to a single page while the destination sg still spans the combined skb->data_len. Restore this combined-length page gate for both IPv4 and IPv6.
Title		xfrm: esp: restore combined single-frag length gate
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/322e48187e0245ab2fff6fec2220b0cae677dbec https://git.kernel.org/stable/c/36519e3d941fc99d3b52c134dbaf311f987a4708 https://git.kernel.org/stable/c/566295735530ee513326049b0540f32ec050bf2e https://git.kernel.org/stable/c/5d7ab86e2b6bc23054616bf6ac562013bf60af8c https://git.kernel.org/stable/c/65f3b3fc2347b89fe21db1e92c7681368415f095 https://git.kernel.org/stable/c/b84091ceddc9f133229dceab3ccc930bf27f9cba https://git.kernel.org/stable/c/c093468aea8277f77272a4f199b2e15e19cabb59 https://git.kernel.org/stable/c/dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:55:17.188Z

Updated: 2026-10-19T20:17:55.311Z

Reserved: 2026-07-19T07:54:57.020Z

Link: CVE-2026-63912

Vulnrichment

Updated: 2026-10-16T15:33:09.478Z

NVD

Status : Awaiting Analysis

Published: 2026-07-19T16:17:09.097

Modified: 2026-10-19T21:17:10.230

Link: CVE-2026-63912

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63912 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T08:30:12Z

Weaknesses

CWE-125
Out-of-bounds Read
CWE-770
Allocation of Resources Without Limits or Throttling

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object