Linux kernel (net/xfrm): The same ownership-marker bug as CVE-2026-53363, in the other IPTFS frag-transfer helper.

Impact

The same ownership-marker bug as CVE-2026-53363, in the other IPTFS frag-transfer helper. Inner packets built from a page-pool-backed receive path look privately owned to ESP, so a nested transport-mode SA decrypts in place and writes over pages the outer IPTFS skb still references. That is attacker-triggered kernel memory corruption from the wire, with a panic as the visible outcome and silent data corruption as the quiet one.

Who can reach it

Inbound ESP/IPTFS traffic. Any peer holding the SA - a peer node on the cluster fabric, or a tenant endpoint terminating an overlay tunnel - drives it by sending traffic that lands on a page-pool receive path (i.e. a normal modern NIC driver). Conditional on IPTFS mode plus a nested transport-mode SA. No local access and no privilege on the target node is required.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version is published in the record). Both this and CVE-2026-53363 must land - they are two separate call sites. Interim control: drop IPTFS mode and nested transport-mode SAs from the encryption design until patched.

References