GHSA-6C6H-95CX-J99F

Vulnerability from github – Published: 2026-07-19 18:31 – Updated: 2026-07-20 15:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

xfrm: esp: restore combined single-frag length gate

The ESP out-of-place fast path appends the trailer in esp_output_head() before esp_output_tail() allocates the destination page frag. The head-side gate currently checks skb->data_len and tailen separately, but the tail code allocates a single destination frag from the combined post-trailer skb->data_len.

Reject the page-frag fast path when the combined aligned length exceeds a page. Otherwise skb_page_frag_refill() may fall back to a single page while the destination sg still spans the combined skb->data_len.

Restore this combined-length page gate for both IPv4 and IPv6.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-63912"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-19T16:17:09Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: esp: restore combined single-frag length gate\n\nThe ESP out-of-place fast path appends the trailer in esp_output_head()\nbefore esp_output_tail() allocates the destination page frag. The\nhead-side gate currently checks skb-\u003edata_len and tailen separately, but\nthe tail code allocates a single destination frag from the combined\npost-trailer skb-\u003edata_len.\n\nReject the page-frag fast path when the combined aligned length exceeds a\npage. Otherwise skb_page_frag_refill() may fall back to a single page while\nthe destination sg still spans the combined skb-\u003edata_len.\n\nRestore this combined-length page gate for both IPv4 and IPv6.",
  "id": "GHSA-6c6h-95cx-j99f",
  "modified": "2026-07-20T15:31:50Z",
  "published": "2026-07-19T18:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63912"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/322e48187e0245ab2fff6fec2220b0cae677dbec"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/36519e3d941fc99d3b52c134dbaf311f987a4708"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/566295735530ee513326049b0540f32ec050bf2e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5d7ab86e2b6bc23054616bf6ac562013bf60af8c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/65f3b3fc2347b89fe21db1e92c7681368415f095"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b84091ceddc9f133229dceab3ccc930bf27f9cba"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c093468aea8277f77272a4f199b2e15e19cabb59"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.