Linux kernel (net/xfrm): IPTFS fragment consumption loses the shared-page marker, so ESP concludes the payload pages

CVSS 9.8CVE-2026-53363Kernel, userspace & hypervisorcurated

Impact

IPTFS fragment consumption loses the shared-page marker, so ESP concludes the payload pages are privately owned and decrypts in place over pages that are still referenced elsewhere - typically read-only page-cache pages. Inbound IPsec traffic therefore silently rewrites memory belonging to other work on the node: file cache corruption for any tenant on that host, and kernel panics once the damaged pages are used.

Who can reach it

Driven by inbound ESP traffic on an IPTFS-mode SA, so any peer that can put packets on the SA reaches it - a node-to-node encryption peer inside the cluster, a compromised node, or the far end of a tenant overlay tunnel. Conditional on IP-TFS mode being in use (CONFIG_XFRM_IPTFS / xfrm_iptfs loaded and an SA configured with mode iptfs). No tenant device node is required; a tenant on the far side of the tunnel or a compromised peer node is enough.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version is published in the record - match by commit with your distro kernel). Interim control: stop using IPTFS mode for node-to-node and tenant-overlay SAs and fall back to plain ESP tunnel mode until the fleet is patched.

References

https://git.kernel.org/stable/c/dd66f7f6e360ee82cd905517726f8e9091265de5 https://git.kernel.org/stable/c/c885d111ed9f5a0a1f3cc4e87a50db6518abaa6c https://nvd.nist.gov/vuln/detail/CVE-2026-53363

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.