Linux kernel skbuff: coalescing drops SKBFL_SHARED_FRAG, letting ESP decrypt in place over shared pages

Impact

skb_try_coalesce() moves paged fragments from one socket buffer to another but loses the SKBFL_SHARED_FRAG marker, so the destination skb no longer advertises that its pages are externally owned or page-cache backed. ESP input relies on skb_has_shared_frag() to decide whether it may skip skb_cow_data() and decrypt in place; with the marker gone it can write plaintext directly over pages that belong to the page cache or another owner. On a GPU node this is a host kernel memory-integrity bug in the receive path, reachable through ordinary TCP receive coalescing plus IPsec, and the fix lands in the host kernel rather than in anything a tenant controls. The record is scored local (AV:L, PR:L) with high confidentiality, integrity and availability impact, and it is listed in CISA KEV. The upstream commit series is public; no exploitation detail is in the record.

Who can reach it

Local, authenticated low-privilege context per the CVSS vector, on a host that terminates IPsec/ESP traffic and performs TCP receive coalescing. Not reachable unless the node actually processes ESP input; a GPU node with no IPsec termination is not exposed through this path.

What to do

Take the stable-kernel fix for your series (five backport commits are referenced) or the distribution kernel update - Red Hat has it queued for RHEL 8 and RHEL 10 streams including the NVIDIA-for-RHEL-10 kernel. A kernel fix of this kind cannot be hot-patched in place by an operator, so each node must be drained and rebooted onto the new kernel; schedule that against jobs that cannot be checkpointed. No vendor-stated mitigation short of patching appears in the record.

References

Related entries

• Glances: KVM domain names are interpolated into shell commands, giving root on the hypervisor hostCVE-2026-46606 · Glances monitoring agent (KVM/QEMU vms plugin, virsh.py domain name interpolation)High
• virtio-win Viosock: integer overflow in the select IOCTL overflows a NonPagedPool array and escalates in the guestCVE-2026-46655 · virtio-win Viosock driver (IOCTL_SELECT, VIOSockSelect bounds check)High
• FreeBSD ZFS: size truncation in ZFS_IOC_USERSPACE_MANY gives a local user a kernel heap overflowCVE-2026-49429 · FreeBSD ZFS (ZFS_IOC_USERSPACE_MANY ioctl)High
• Linux kernel SO_REUSEPORT: cBPF program freed without an RCU grace period, use-after-free in UDP receiveCVE-2026-52910 · Linux kernel net/core sock_reuseport (cBPF program freed without RCU grace period)High
• Linux kernel io_uring poll: cancel flag makes the ownership slowpath unreachableCVE-2026-52933 · Linux kernel io_uring (io_poll_get_ownership signed refcount comparison)High
• Linux kernel (net/xfrm): ESP-in-TCP keeps a single in-flight transmit. For a blocking caller the flush of that stateCVE-2026-52935 · Linux kernel (net/xfrm)High