{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63912","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T07:54:57.020Z","datePublished":"2026-07-19T14:55:17.188Z","dateUpdated":"2026-08-05T12:37:06.161Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:37:06.161Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: esp: restore combined single-frag length gate\n\nThe ESP out-of-place fast path appends the trailer in esp_output_head()\nbefore esp_output_tail() allocates the destination page frag. The\nhead-side gate currently checks skb->data_len and tailen separately, but\nthe tail code allocates a single destination frag from the combined\npost-trailer skb->data_len.\n\nReject the page-frag fast path when the combined aligned length exceeds a\npage. Otherwise skb_page_frag_refill() may fall back to a single page while\nthe destination sg still spans the combined skb->data_len.\n\nRestore this combined-length page gate for both IPv4 and IPv6."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the ESP outbound encryption path reached when IPsec-protected traffic is sent through xfrm (e.g., from an internet-facing VPN/tunnel gateway encrypting responses or forwarded flows to a remote peer). A network peer can influence outbound skb fragment sizes to hit the vulnerable fast path without local shell access.\nAC:L - An attacker can reliably craft payload sizes so ALIGN(skb->data_len) and ALIGN(tailen) each pass the broken per-field PAGE_SIZE gate while their combined aligned length exceeds PAGE_SIZE, repeatedly probing until the out-of-place page-frag path is taken.\nPR:N - Exploitation does not require configuring xfrm or host admin rights; it only needs the target to already run ESP and the attacker to send traffic that is encrypted on output (e.g., as a remote VPN/site-to-site peer), which is network-layer access rather than local OS privilege.\nUI:N - Triggering the vulnerable ESP output path requires only attacker-controlled network traffic and does not depend on any victim user action such as mounting a filesystem or opening a file.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security authority, not a cross-boundary escape such as guest-to-host VM breakout or IOMMU bypass.\nC:H - The flaw is a heap out-of-bounds write during AEAD encryption over an undersized page frag; such memory corruption can expose adjacent kernel objects and be leveraged for arbitrary memory disclosure, not merely a bounded leak.\nI:H - Writing past the allocated page-frag buffer corrupts adjacent heap memory and can be developed into arbitrary write or control-flow hijack primitives, matching kernel guidance for out-of-bounds writes.\nA:H - Corrupting kernel heap memory during crypto output can cause immediate kernel oops/panic or persistent instability, and repeated triggering can deny service on VPN gateways and other IPsec endpoints."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/esp4.c","net/ipv6/esp6.c"],"versions":[{"version":"c075c3ea031757f8ea2d34567565b61a868c08d5","lessThan":"566295735530ee513326049b0540f32ec050bf2e","status":"affected","versionType":"git"},{"version":"a583f2f3c8788bffd7fd7baeb76bd6d80543d7ea","lessThan":"5d7ab86e2b6bc23054616bf6ac562013bf60af8c","status":"affected","versionType":"git"},{"version":"5bd8baab087dff657e05387aee802e70304cc813","lessThan":"36519e3d941fc99d3b52c134dbaf311f987a4708","status":"affected","versionType":"git"},{"version":"5bd8baab087dff657e05387aee802e70304cc813","lessThan":"322e48187e0245ab2fff6fec2220b0cae677dbec","status":"affected","versionType":"git"},{"version":"5bd8baab087dff657e05387aee802e70304cc813","lessThan":"b84091ceddc9f133229dceab3ccc930bf27f9cba","status":"affected","versionType":"git"},{"version":"5bd8baab087dff657e05387aee802e70304cc813","lessThan":"c093468aea8277f77272a4f199b2e15e19cabb59","status":"affected","versionType":"git"},{"version":"5bd8baab087dff657e05387aee802e70304cc813","lessThan":"65f3b3fc2347b89fe21db1e92c7681368415f095","status":"affected","versionType":"git"},{"version":"5bd8baab087dff657e05387aee802e70304cc813","lessThan":"dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40","status":"affected","versionType":"git"},{"version":"2c66b0c95bb0aa7652ba1eba293d0d5993b35a38","status":"affected","versionType":"git"},{"version":"ef6f83df1209a7d9bd1c605a62457d4c00f9179e","status":"affected","versionType":"git"},{"version":"3defefd22ad5fbbe639b6157fb7e6311b2bf333d","status":"affected","versionType":"git"},{"version":"b657030870bb5351c5b1e84d4e9f186da6ca0496","status":"affected","versionType":"git"},{"version":"5.10.113","lessThan":"5.10.259","status":"affected","versionType":"semver"},{"version":"5.15.36","lessThan":"5.15.210","status":"affected","versionType":"semver"},{"version":"4.14.288","lessThan":"4.15","status":"affected","versionType":"semver"},{"version":"4.19.252","lessThan":"4.20","status":"affected","versionType":"semver"},{"version":"5.4.205","lessThan":"5.5","status":"affected","versionType":"semver"},{"version":"5.17.5","lessThan":"5.18","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/esp4.c","net/ipv6/esp6.c"],"versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","status":"unaffected","versionType":"semver"},{"version":"5.10.259","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.210","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.35","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.12","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.113","versionEndExcluding":"5.10.259"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.36","versionEndExcluding":"5.15.210"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.1.176"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.6.143"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.12.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.18.35"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"7.0.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"7.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.288"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.252"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.205"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17.5"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/566295735530ee513326049b0540f32ec050bf2e"},{"url":"https://git.kernel.org/stable/c/5d7ab86e2b6bc23054616bf6ac562013bf60af8c"},{"url":"https://git.kernel.org/stable/c/36519e3d941fc99d3b52c134dbaf311f987a4708"},{"url":"https://git.kernel.org/stable/c/322e48187e0245ab2fff6fec2220b0cae677dbec"},{"url":"https://git.kernel.org/stable/c/b84091ceddc9f133229dceab3ccc930bf27f9cba"},{"url":"https://git.kernel.org/stable/c/c093468aea8277f77272a4f199b2e15e19cabb59"},{"url":"https://git.kernel.org/stable/c/65f3b3fc2347b89fe21db1e92c7681368415f095"},{"url":"https://git.kernel.org/stable/c/dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40"}],"title":"xfrm: esp: restore combined single-frag length gate","x_generator":{"engine":"bippy-1.2.0"}}}}