PT-2026-61229 · Linux · Linux

CVE-2026-63912 · Published 2026-07-19 · Updated 2026-07-19

NVD

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

xfrm: esp: restore combined single-frag length gate

The ESP out-of-place fast path appends the trailer in esp output head() before esp output tail() allocates the destination page frag. The head-side gate currently checks skb->data len and tailen separately, but the tail code allocates a single destination frag from the combined post-trailer skb->data len.

Reject the page-frag fast path when the combined aligned length exceeds a page. Otherwise skb page frag refill() may fall back to a single page while the destination sg still spans the combined skb->data len.

Restore this combined-length page gate for both IPv4 and IPv6.

Fix

Related Identifiers

CVE-2026-63912

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-63912 · Security Note
• https://git.kernel.org/stable/c/c093468aea8277f77272a4f199b2e15e19cabb59 · Note
• https://git.kernel.org/stable/c/566295735530ee513326049b0540f32ec050bf2e · Note
• https://git.kernel.org/stable/c/65f3b3fc2347b89fe21db1e92c7681368415f095 · Note
• https://git.kernel.org/stable/c/36519e3d941fc99d3b52c134dbaf311f987a4708 · Note
• https://git.kernel.org/stable/c/b84091ceddc9f133229dceab3ccc930bf27f9cba · Note
• https://git.kernel.org/stable/c/322e48187e0245ab2fff6fec2220b0cae677dbec · Note
• https://git.kernel.org/stable/c/dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40 · Note
• https://git.kernel.org/stable/c/5d7ab86e2b6bc23054616bf6ac562013bf60af8c · Note