CVE-2026-64566

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()

When iptfs_skb_add_frags() copies frag references from the source

frag walk into a new SKB, it increments the page reference count via

__skb_frag_ref() but does not propagate SKBFL_SHARED_FRAG to the

destination SKB's skb_shinfo->flags.

If the source SKB carries shared frags (e.g. from a page-pool backed

receive path), the new inner SKB will appear to ESP as having privately

owned frags. A subsequent esp_input() call for a nested transport-mode

SA then takes the no-COW fast path and decrypts in place, writing over

pages that are still referenced by the outer IPTFS SKB. This causes

kernel-visible memory corruption and can trigger a panic.

All other frag-transfer helpers in the kernel (skb_try_coalesce,

skb_gro_receive, __pskb_copy_fclone, skb_shift, skb_segment) correctly

propagate SKBFL_SHARED_FRAG; align iptfs_skb_add_frags() with this

convention

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References