Linux kernel (net/xfrm): The ESP-in-TCP send path mis-tracked scatter-gather message offsets and socket memory charges

Impact

The ESP-in-TCP send path mis-tracked scatter-gather message offsets and socket memory charges whenever a send completed only partially, rather than using the helper that keeps the message consistent at every step. Wrong offsets on a partially-sent message are the same defect family as CVE-2026-52935 in this file, and the CNA scores this one as remotely reachable with no privileges. Read it as: the transmit state describing where encrypted bytes live can disagree with reality, with socket accounting drifting alongside it.

Who can reach it

Any process that attaches the espintcp ULP to a TCP socket (no capability required beyond owning the socket) and sends data that the peer only partially consumes - a slow or deliberately stalling peer on the fabric is enough to force the partial-send path repeatedly. Conditional on CONFIG_INET_ESPINTCP. Be aware the upstream commit message is unusually terse ('fixes some bugs in skmsg accounting') and does not spell out the memory-safety consequence; the 9.8 network/no-privilege score is the CNA's, not derived from the message.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published); take it together with CVE-2026-52935, which touches the same partial-send state. Interim control: disable CONFIG_INET_ESPINTCP where IPsec-over-TCP is not required.

References

Related entries

• Linux kernel (net/xfrm): NAT-keepalive frees the keepalive skb whenever the IPv4/IPv6 send helper returns an errorCVE-2026-72137 · Linux kernel (net/xfrm)Critical
• Linux kernel (net/xfrm): The IPsec input path validates a security association before taking the state lock, so a stateCVE-2026-72451 · Linux kernel (net/xfrm)Critical
• Linux kernel (net/xfrm): Async ESP resumption holds a reference on the original skbCVE-2026-72463 · Linux kernel (net/xfrm)Critical
• Linux kernel (net/xfrm): An unlocked read of the IPTFS reassembly state lets two CPUs disagree about who owns a socketCVE-2026-53240 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): Transport-mode reinjection stashes a network-namespace pointer in the socket buffer's controlCVE-2026-63919 · Linux kernel (net/xfrm)High
• Linux kernel (net/xfrm): The rtnetlink changelink path for xfrm interfaces checked CAP_NET_ADMIN only against theCVE-2026-72136 · Linux kernel (net/xfrm)High