CVE-2026-52935

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: espintcp: do not reuse an in-progress partial send

espintcp keeps a single in-flight transmit in ctx->partial.

Before building a new sk_msg, espintcp_sendmsg() first tries to flush

that state through espintcp_push_msgs().

For blocking callers, espintcp_push_msgs() may return success even when

the previous partial send is still pending. espintcp_sendmsg() would

then reinitialize emsg->skmsg and reuse ctx->partial while the old

transfer still owns that state.

Do not rebuild the send message when ctx->partial is still in progress.

If espintcp_push_msgs() returns with emsg->len still set, fail the new

send instead of overwriting the live partial state.

This is a memory-safety fix: reusing the live partial-send state can

leave a stale offset attached to a new sk_msg and lead to an out-of-

bounds read in the send path.

tcp_sendmsg_locked() already handles waiting for send buffer memory, so

the fix here is just to

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References