Linux kernel (net/xfrm): A peer that mixes zero-copy-eligible and copy-path IPTFS fragments in one datagram makes

CVSS 7.5CVE-2026-31517Kernel, userspace & hypervisorcurated

Impact

A peer that mixes zero-copy-eligible and copy-path IPTFS fragments in one datagram makes reassembly call skb_put() on an already non-linear buffer, hitting SKB_LINEAR_ASSERT and taking an invalid-opcode fault in NAPI softirq. That is a hard kernel panic driven by packet shape - every tenant on the node loses its GPUs, and the sender can repeat it after each reboot.

Who can reach it

Inbound ESP on an IPTFS SA; the fragment sequence is chosen by the sender, so any peer holding the SA reaches it - a peer node, a compromised node, or the far side of a tenant overlay tunnel. The published call trace runs straight from the NIC driver's NAPI poll through xfrm4_esp_rcv into iptfs_reassem_cont, so no local access or tenant device node is involved. Conditional on IPTFS mode being configured.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published). Interim control: disable IP-TFS mode on SAs that terminate traffic from tenants or from nodes you do not fully trust.

References

https://git.kernel.org/stable/c/33a7b36268933c75bdc355e5531951e0ea9f1951 https://git.kernel.org/stable/c/7fdfe8f6efeb0e1200e22a903f2471539f54522b https://nvd.nist.gov/vuln/detail/CVE-2026-31517

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.