---
id: CVE-2026-63912
title: 'xfrm: esp: restore combined single-frag length gate'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xfrm: esp: restore combined single-frag length gate

  The ESP out-of-place fast path appends the trailer in esp_output_head()
  before esp_output_tail() allocates the dest…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c075c3ea031757f8ea2d34567565b61a868c08d5 <
    566295735530ee513326049b0540f32ec050bf2e
  - >-
    Linux >= a583f2f3c8788bffd7fd7baeb76bd6d80543d7ea <
    5d7ab86e2b6bc23054616bf6ac562013bf60af8c
  - >-
    Linux >= 5bd8baab087dff657e05387aee802e70304cc813 <
    36519e3d941fc99d3b52c134dbaf311f987a4708
  - >-
    Linux >= 5bd8baab087dff657e05387aee802e70304cc813 <
    322e48187e0245ab2fff6fec2220b0cae677dbec
  - >-
    Linux >= 5bd8baab087dff657e05387aee802e70304cc813 <
    b84091ceddc9f133229dceab3ccc930bf27f9cba
  - >-
    Linux >= 5bd8baab087dff657e05387aee802e70304cc813 <
    c093468aea8277f77272a4f199b2e15e19cabb59
  - >-
    Linux >= 5bd8baab087dff657e05387aee802e70304cc813 <
    65f3b3fc2347b89fe21db1e92c7681368415f095
  - >-
    Linux >= 5bd8baab087dff657e05387aee802e70304cc813 <
    dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40
  - Linux 2c66b0c95bb0aa7652ba1eba293d0d5993b35a38
  - Linux ef6f83df1209a7d9bd1c605a62457d4c00f9179e
  - Linux 3defefd22ad5fbbe639b6157fb7e6311b2bf333d
  - Linux b657030870bb5351c5b1e84d4e9f186da6ca0496
  - Linux >= 5.10.113 < 5.10.259
  - Linux >= 5.15.36 < 5.15.210
  - Linux >= 4.14.288 < 4.15
  - Linux >= 4.19.252 < 4.20
  - Linux >= 5.4.205 < 5.5
  - Linux >= 5.17.5 < 5.18
  - Linux 5.18
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:33:08.898705Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:10.792Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63912'
references:
  - url: 'https://git.kernel.org/stable/c/566295735530ee513326049b0540f32ec050bf2e'
  - url: 'https://git.kernel.org/stable/c/5d7ab86e2b6bc23054616bf6ac562013bf60af8c'
  - url: 'https://git.kernel.org/stable/c/36519e3d941fc99d3b52c134dbaf311f987a4708'
  - url: 'https://git.kernel.org/stable/c/322e48187e0245ab2fff6fec2220b0cae677dbec'
  - url: 'https://git.kernel.org/stable/c/b84091ceddc9f133229dceab3ccc930bf27f9cba'
  - url: 'https://git.kernel.org/stable/c/c093468aea8277f77272a4f199b2e15e19cabb59'
  - url: 'https://git.kernel.org/stable/c/65f3b3fc2347b89fe21db1e92c7681368415f095'
  - url: 'https://git.kernel.org/stable/c/dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40'
tags:
  - cve.org
epss: 0.00714
epssPercentile: 0.52731
ingestedAt: '2026-10-16T17:24:46.777Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xfrm: esp: restore combined single-frag length gate

The ESP out-of-place fast path appends the trailer in esp_output_head()
before esp_output_tail() allocates the destination page frag. The
head-side gate currently checks skb->data_len and tailen separately, but
the tail code allocates a single destination frag from the combined
post-trailer skb->data_len.

Reject the page-frag fast path when the combined aligned length exceeds a
page. Otherwise skb_page_frag_refill() may fall back to a single page while
the destination sg still spans the combined skb->data_len.

Restore this combined-length page gate for both IPv4 and IPv6.

## Affected

- `Linux >= c075c3ea031757f8ea2d34567565b61a868c08d5 < 566295735530ee513326049b0540f32ec050bf2e`
- `Linux >= a583f2f3c8788bffd7fd7baeb76bd6d80543d7ea < 5d7ab86e2b6bc23054616bf6ac562013bf60af8c`
- `Linux >= 5bd8baab087dff657e05387aee802e70304cc813 < 36519e3d941fc99d3b52c134dbaf311f987a4708`
- `Linux >= 5bd8baab087dff657e05387aee802e70304cc813 < 322e48187e0245ab2fff6fec2220b0cae677dbec`
- `Linux >= 5bd8baab087dff657e05387aee802e70304cc813 < b84091ceddc9f133229dceab3ccc930bf27f9cba`
- `Linux >= 5bd8baab087dff657e05387aee802e70304cc813 < c093468aea8277f77272a4f199b2e15e19cabb59`
- `Linux >= 5bd8baab087dff657e05387aee802e70304cc813 < 65f3b3fc2347b89fe21db1e92c7681368415f095`
- `Linux >= 5bd8baab087dff657e05387aee802e70304cc813 < dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40`
- `Linux 2c66b0c95bb0aa7652ba1eba293d0d5993b35a38`
- `Linux ef6f83df1209a7d9bd1c605a62457d4c00f9179e`
- `Linux 3defefd22ad5fbbe639b6157fb7e6311b2bf333d`
- `Linux b657030870bb5351c5b1e84d4e9f186da6ca0496`
- `Linux >= 5.10.113 < 5.10.259`
- `Linux >= 5.15.36 < 5.15.210`
- `Linux >= 4.14.288 < 4.15`
- `Linux >= 4.19.252 < 4.20`
- `Linux >= 5.4.205 < 5.5`
- `Linux >= 5.17.5 < 5.18`
- `Linux 5.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.