Linux kernel (net/xfrm): ESP-in-TCP keeps a single in-flight transmit. For a blocking caller the flush of that state

Impact

ESP-in-TCP keeps a single in-flight transmit. For a blocking caller the flush of that state can report success while the previous partial send is still live, so the socket rebuilds its scatter-gather message over state the old transfer still owns. Upstream calls this a memory-safety fix explicitly: a stale offset carried into a fresh message produces an out-of-bounds read on the send path, leaking adjacent kernel memory into the encrypted stream or faulting.

Who can reach it

A local process that attaches the espintcp ULP to a TCP socket - setsockopt(TCP_ULP, "espintcp"), which needs nothing beyond owning the socket, so any unprivileged tenant process qualifies - and then issues blocking sendmsg calls that only partially complete. Partial completion is easy to force by shrinking the send buffer or by having a slow peer. Conditional on CONFIG_INET_ESPINTCP being enabled in the kernel, which it is in most distro builds.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published). Interim control: build or ship kernels without CONFIG_INET_ESPINTCP where IPsec-over-TCP is not needed, which removes the ULP entirely.

References

Related entries

• Linux kernel (net/xfrm): Policy deletion dropped the policy lock before pruning the inexact-policy bin, and aCVE-2026-53239 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Cloning an IPTFS security association kmemdups the mode data, so the clone shares the originalCVE-2026-63911 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): An unprivileged user who can create IPsec SAs turns one outbound datagram into a multi-exabyteCVE-2026-64009 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Setting a per-socket IPsec policy reset the socket's destination cache non-atomically whileCVE-2026-64581 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Xfrm_selector_match() compared selectors without checking that the selector family matches theCVE-2026-72450 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Several error paths in the ESP-in-TCP receive code return without freeing the skb, soCVE-2025-38057 · Linux kernel (net/xfrm)High