CVE-2026-64566
Received Received - Intake

Memory Corruption in Linux Kernel XFRM iptfs

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags() When iptfs_skb_add_frags() copies frag references from the source frag walk into a new SKB, it increments the page reference count via __skb_frag_ref() but does not propagate SKBFL_SHARED_FRAG to the destination SKB's skb_shinfo->flags. If the source SKB carries shared frags (e.g. from a page-pool backed receive path), the new inner SKB will appear to ESP as having privately owned frags. A subsequent esp_input() call for a nested transport-mode SA then takes the no-COW fast path and decrypts in place, writing over pages that are still referenced by the outer IPTFS SKB. This causes kernel-visible memory corruption and can trigger a panic. All other frag-transfer helpers in the kernel (skb_try_coalesce, skb_gro_receive, __pskb_copy_fclone, skb_shift, skb_segment) correctly propagate SKBFL_SHARED_FRAG; align iptfs_skb_add_frags() with this convention by setting the flag inside the loop immediately after __skb_frag_ref() and nr_frags++, so every exit path that attaches a frag unconditionally propagates SKBFL_SHARED_FRAG.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-64566
EUVD
EUVD-2026-53260

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of shared memory fragments in the IPTFS (IP Traffic Flow Security) subsystem. When copying data between network buffers, the code fails to mark the destination buffer as using shared fragments. This can lead to memory corruption when encryption is applied, as the system may incorrectly modify memory still in use by other parts of the kernel.

Detection Guidance

This vulnerability is specific to the Linux kernel's xfrm subsystem and IPTFS functionality. Detection requires checking kernel logs for memory corruption or panics related to IPTFS or ESP decryption. Monitor for kernel oops messages or crashes involving xfrm or iptfs modules.

Impact Analysis

This vulnerability can cause kernel crashes (panics) and memory corruption, potentially leading to system instability or denial of service. If exploited, it may allow unauthorized memory access or privilege escalation, though exploitation requires specific network conditions and configurations.

Compliance Impact

This vulnerability causes kernel memory corruption which could lead to system instability or crashes. While not directly related to data privacy, such instability may impact systems handling sensitive data, potentially affecting compliance with standards like GDPR or HIPAA that require secure and reliable data processing environments.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If patches are unavailable, disable IPTFS functionality or avoid using nested transport-mode ESP configurations. Monitor kernel security advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64566. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart