Linux kernel (net/xfrm): The same ownership-marker bug as CVE-2026-53363, in the other IPTFS frag-transfer helper.

Impact

The same ownership-marker bug as CVE-2026-53363, in the other IPTFS frag-transfer helper. Inner packets built from a page-pool-backed receive path look privately owned to ESP, so a nested transport-mode SA decrypts in place and writes over pages the outer IPTFS skb still references. That is attacker-triggered kernel memory corruption from the wire, with a panic as the visible outcome and silent data corruption as the quiet one.

Who can reach it

Inbound ESP/IPTFS traffic. Any peer holding the SA - a peer node on the cluster fabric, or a tenant endpoint terminating an overlay tunnel - drives it by sending traffic that lands on a page-pool receive path (i.e. a normal modern NIC driver). Conditional on IPTFS mode plus a nested transport-mode SA. No local access and no privilege on the target node is required.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version is published in the record). Both this and CVE-2026-53363 must land - they are two separate call sites. Interim control: drop IPTFS mode and nested transport-mode SAs from the encryption design until patched.

References

Related entries

• Linux kernel (net/xfrm): When IPsec crypto offload takes a GSO segment asynchronously, the segment is unlinked from theCVE-2026-68426 · Linux kernel (net/xfrm)Critical
• Linux kernel (net/xfrm): The ESP-in-TCP send path mis-tracked scatter-gather message offsets and socket memory chargesCVE-2026-72041 · Linux kernel (net/xfrm)Critical
• Linux kernel (net/xfrm): NAT-keepalive frees the keepalive skb whenever the IPv4/IPv6 send helper returns an errorCVE-2026-72137 · Linux kernel (net/xfrm)Critical
• Linux kernel (net/xfrm): The IPsec input path validates a security association before taking the state lock, so a stateCVE-2026-72451 · Linux kernel (net/xfrm)Critical
• Linux kernel (net/xfrm): Async ESP resumption holds a reference on the original skbCVE-2026-72463 · Linux kernel (net/xfrm)Critical
• Linux kernel (net/xfrm): An unlocked read of the IPTFS reassembly state lets two CPUs disagree about who owns a socketCVE-2026-53240 · Linux kernel (net/xfrm)High