CVE-2026-52935

Analyzed Analyzed - Analysis Complete

espintcp Partial Send State Reuse in Linux Kernel

Publication date: 2026-06-24

Last updated on: 2026-07-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: do not reuse an in-progress partial send espintcp keeps a single in-flight transmit in ctx->partial. Before building a new sk_msg, espintcp_sendmsg() first tries to flush that state through espintcp_push_msgs(). For blocking callers, espintcp_push_msgs() may return success even when the previous partial send is still pending. espintcp_sendmsg() would then reinitialize emsg->skmsg and reuse ctx->partial while the old transfer still owns that state. Do not rebuild the send message when ctx->partial is still in progress. If espintcp_push_msgs() returns with emsg->len still set, fail the new send instead of overwriting the live partial state. This is a memory-safety fix: reusing the live partial-send state can leave a stale offset attached to a new sk_msg and lead to an out-of- bounds read in the send path. tcp_sendmsg_locked() already handles waiting for send buffer memory, so the fix here is just to preserve espintcp's one-message-at-a-time transmit state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-08

Generated

2026-07-14

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-52935

EUVD

EUVD-2026-38705

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.36 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.94 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.6 (inc) to 5.10.259 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's espintcp component, which handles TCP encapsulation for IPsec. The issue arises because espintcp reuses a partial send state (ctx->partial) that is still in progress. Specifically, before sending a new message, espintcp_sendmsg() tries to flush the previous partial send via espintcp_push_msgs(). However, espintcp_push_msgs() may report success even if the previous send is not complete, leading espintcp_sendmsg() to reuse and overwrite the partial send state prematurely.

This improper reuse can cause a stale offset to be attached to a new send message, resulting in an out-of-bounds read during the send operation. The vulnerability is a memory-safety issue that could lead to unexpected behavior or crashes in the kernel's networking stack.

Impact Analysis

This vulnerability can impact you by causing memory safety issues in the Linux kernel's networking code. Specifically, it can lead to out-of-bounds reads during TCP message sending in the espintcp module. Such memory errors can cause system instability, crashes, or potentially allow attackers to exploit the kernel for further attacks, depending on the context and usage.

Mitigation Strategies

The vulnerability has been resolved in the Linux kernel by fixing the espintcp send message handling to prevent reuse of an in-progress partial send, which could lead to out-of-bounds reads.

To mitigate this vulnerability, you should update your Linux kernel to the version that includes this fix.

Hi! I’m here to help you understand CVE-2026-52935. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70