CVE-2026-63912 - Vulnerability Details

- xfrm: esp: restore combined single-frag length gate

Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: esp: restore combined single-frag length gate

The ESP out-of-place fast path appends the trailer in esp_output_head()
before esp_output_tail() allocates the destination page frag. The
head-side gate currently checks skb->data_len and tailen separately, but
the tail code allocates a single destination frag from the combined
post-trailer skb->data_len.

Reject the page-frag fast path when the combined aligned length exceeds a
page. Otherwise skb_page_frag_refill() may fall back to a single page while
the destination sg still spans the combined skb->data_len.

Restore this combined-length page gate for both IPv4 and IPv6.

Published: 2026-07-19

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability lies in the Linux kernel’s ESP handling. During fast‑path processing, a check that ensures the combined length of the packet trailer and payload does not exceed a page is omitted. An attacker that can supply crafted ESP packets may cause memory corruption due to improper allocation, potentially leading to privilege escalation or a denial of service. The flaw is associated with CWE‑770.

Affected Systems

All Linux kernel releases are affected until the kernel incorporates the patch that restores the combined‑length gate. Any system running a vulnerable kernel is at risk, irrespective of vendor or version.

Risk and Exploitability

The flaw has a CVSS score of 9.8 and an EPSS score of less than 1 %. Although exploitation is unlikely under normal conditions, the impact is severe and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote network‑based, requiring the ability to forge or inject ESP packets toward the target. Successful exploitation would allow privilege escalation or complete control of the affected host.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c075c3ea031757f8ea2d34567565b61a868c08d5`	affected	< 566295735530ee513326049b0540f32ec050bf2e
`a583f2f3c8788bffd7fd7baeb76bd6d80543d7ea`	affected	< 5d7ab86e2b6bc23054616bf6ac562013bf60af8c
`5bd8baab087dff657e05387aee802e70304cc813`	affected	< 36519e3d941fc99d3b52c134dbaf311f987a4708
`5bd8baab087dff657e05387aee802e70304cc813`	affected	< 322e48187e0245ab2fff6fec2220b0cae677dbec
`5bd8baab087dff657e05387aee802e70304cc813`	affected	< b84091ceddc9f133229dceab3ccc930bf27f9cba
`5bd8baab087dff657e05387aee802e70304cc813`	affected	< c093468aea8277f77272a4f199b2e15e19cabb59
`5bd8baab087dff657e05387aee802e70304cc813`	affected	< 65f3b3fc2347b89fe21db1e92c7681368415f095
`5bd8baab087dff657e05387aee802e70304cc813`	affected	< dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40
`2c66b0c95bb0aa7652ba1eba293d0d5993b35a38`	affected	—
`ef6f83df1209a7d9bd1c605a62457d4c00f9179e`	affected	—
`3defefd22ad5fbbe639b6157fb7e6311b2bf333d`	affected	—
`b657030870bb5351c5b1e84d4e9f186da6ca0496`	affected	—
`5.10.113`	affected	< 5.10.259
`5.15.36`	affected	< 5.15.210
`4.14.288`	affected	< 4.15
`4.19.252`	affected	< 4.20
`5.4.205`	affected	< 5.5
`5.17.5`	affected	< 5.18

Linux

affected

Version	Status	Constraints
`5.18`	affected	—
`0`	unaffected	< 5.18
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c075c3ea031757f8ea2d34567565b61a868c08d5,566295735530ee513326049b0540f32ec050bf2e)`	affected	code_commit	—
`[a583f2f3c8788bffd7fd7baeb76bd6d80543d7ea,5d7ab86e2b6bc23054616bf6ac562013bf60af8c)`	affected	code_commit	—
`[5bd8baab087dff657e05387aee802e70304cc813,36519e3d941fc99d3b52c134dbaf311f987a4708)`	affected	code_commit	—
`[5bd8baab087dff657e05387aee802e70304cc813,322e48187e0245ab2fff6fec2220b0cae677dbec)`	affected	code_commit	—
`[5bd8baab087dff657e05387aee802e70304cc813,b84091ceddc9f133229dceab3ccc930bf27f9cba)`	affected	code_commit	—
`[5bd8baab087dff657e05387aee802e70304cc813,c093468aea8277f77272a4f199b2e15e19cabb59)`	affected	code_commit	—
`[5bd8baab087dff657e05387aee802e70304cc813,65f3b3fc2347b89fe21db1e92c7681368415f095)`	affected	code_commit	—
`[5bd8baab087dff657e05387aee802e70304cc813,dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40)`	affected	code_commit	—
`2c66b0c95bb0aa7652ba1eba293b35a38`	affected	code_commit	—
`ef6f83df1209a7d9bd1c605a62457d4c00f9179e`	affected	code_commit	—
`3defefd22ad5fbbe639b6157fb7e6311b2bf333d`	affected	code_commit	—
`b657030870bb5351c5b1e84d4e9f186da6ca0496`	affected	code_commit	—
`[5.10.113,5.10.259)`	affected	semver	—
`[5.15.36,5.15.210)`	affected	semver	—
`[4.14.288,4.15)`	affected	semver	—
`[4.19.252,4.20)`	affected	semver	—
`[5.4.205,5.5)`	affected	semver	—
`[5.17.5,5.18)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.18`	affected	semver	—
`[0,5.18)`	unaffected	semver	—
`[5.10.259,5.11.0)`	unaffected	semver	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.93,6.13.0)`	unaffected	semver	—
`[6.18.35,6.19.0)`	unaffected	semver	—
`[7.0.12,7.1.0)`	unaffected	semver	—
`[7.1,*)`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the updated kernel that restores the combined‑length gate for ESP packet processing, mitigating the memory allocation flaw described by CWE‑770.
Deploy firewall rules to restrict or monitor inbound ESP traffic, thereby reducing exposure to crafted packets that could trigger the memory corruption.
Continuously monitor system logs for unusual ESP‑related activity and enforce stricter network segmentation to block untrusted traffic.

Generated by OpenCVE AI on August 5, 2026 at 02:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00704.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/322e48187e0245ab2fff6fec2220b0cae677dbec
https://git.kernel.org/stable/c/36519e3d941fc99d3b52c134dbaf311f987a4708
https://git.kernel.org/stable/c/566295735530ee513326049b0540f32ec050bf2e
https://git.kernel.org/stable/c/5d7ab86e2b6bc23054616bf6ac562013bf60af8c
https://git.kernel.org/stable/c/65f3b3fc2347b89fe21db1e92c7681368415f095
https://git.kernel.org/stable/c/b84091ceddc9f133229dceab3ccc930bf27f9cba
https://git.kernel.org/stable/c/c093468aea8277f77272a4f199b2e15e19cabb59
https://git.kernel.org/stable/c/dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40
https://lore.kernel.org/linux-cve-announce/2026071946-CVE-2026-63912-a43c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63912
https://www.cve.org/CVERecord?id=CVE-2026-63912

History

Sun, 26 Jul 2026 08:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119

Wed, 22 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-770
References		https://lore.kernel.org/linux-cve-announce/2026071946-CVE-2026-63912-a43c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63912 https://www.cve.org/CVERecord?id=CVE-2026-63912
Metrics	threat_severity `None`	threat_severity `Moderate`

Tue, 21 Jul 2026 23:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in esp_output_head() before esp_output_tail() allocates the destination page frag. The head-side gate currently checks skb->data_len and tailen separately, but the tail code allocates a single destination frag from the combined post-trailer skb->data_len. Reject the page-frag fast path when the combined aligned length exceeds a page. Otherwise skb_page_frag_refill() may fall back to a single page while the destination sg still spans the combined skb->data_len. Restore this combined-length page gate for both IPv4 and IPv6.
Title		xfrm: esp: restore combined single-frag length gate
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/322e48187e0245ab2fff6fec2220b0cae677dbec https://git.kernel.org/stable/c/36519e3d941fc99d3b52c134dbaf311f987a4708 https://git.kernel.org/stable/c/566295735530ee513326049b0540f32ec050bf2e https://git.kernel.org/stable/c/5d7ab86e2b6bc23054616bf6ac562013bf60af8c https://git.kernel.org/stable/c/65f3b3fc2347b89fe21db1e92c7681368415f095 https://git.kernel.org/stable/c/b84091ceddc9f133229dceab3ccc930bf27f9cba https://git.kernel.org/stable/c/c093468aea8277f77272a4f199b2e15e19cabb59 https://git.kernel.org/stable/c/dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:55:17.188Z

Updated: 2026-08-05T12:37:06.161Z

Reserved: 2026-07-19T07:54:57.020Z

Link: CVE-2026-63912

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63912 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-05T02:30:03Z

Weaknesses

CWE-770
Allocation of Resources Without Limits or Throttling

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object