Linux kernel (net/xfrm): The ESP-in-TCP send path mis-tracked scatter-gather message offsets and socket memory charges

Impact

The ESP-in-TCP send path mis-tracked scatter-gather message offsets and socket memory charges whenever a send completed only partially, rather than using the helper that keeps the message consistent at every step. Wrong offsets on a partially-sent message are the same defect family as CVE-2026-52935 in this file, and the CNA scores this one as remotely reachable with no privileges. Read it as: the transmit state describing where encrypted bytes live can disagree with reality, with socket accounting drifting alongside it.

Who can reach it

Any process that attaches the espintcp ULP to a TCP socket (no capability required beyond owning the socket) and sends data that the peer only partially consumes - a slow or deliberately stalling peer on the fabric is enough to force the partial-send path repeatedly. Conditional on CONFIG_INET_ESPINTCP. Be aware the upstream commit message is unusually terse ('fixes some bugs in skmsg accounting') and does not spell out the memory-safety consequence; the 9.8 network/no-privilege score is the CNA's, not derived from the message.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published); take it together with CVE-2026-52935, which touches the same partial-send state. Interim control: disable CONFIG_INET_ESPINTCP where IPsec-over-TCP is not required.

References