Linux Kernel: SKBFL_SHARED_FRAG not preserved in iptfs_consume_frags (CVE-2026-53363)
CVE-2026-53363 Published on July 10, 2026
xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
In the Linux kernel, the following vulnerability has been resolved:
xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
iptfs_consume_frags() transfers paged fragments from one socket buffer
to another but fails to propagate the SKBFL_SHARED_FRAG flag. This is
the same class of bug that was fixed in skb_try_coalesce() for
CVE-2026-46300: when fragments backed by read-only page-cache pages are
merged, the marker indicating their shared nature must be preserved so
that ESP can decide correctly whether in-place encryption is safe.
Apply the same two-line fix used in skb_try_coalesce() to
iptfs_consume_frags().
Products Associated with CVE-2026-53363
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version b96ba312e21c9b7ac1526829b9640ddc06695c0b and below dd66f7f6e360ee82cd905517726f8e9091265de5 is affected.
- Version b96ba312e21c9b7ac1526829b9640ddc06695c0b and below c885d111ed9f5a0a1f3cc4e87a50db6518abaa6c is affected.
- Version b96ba312e21c9b7ac1526829b9640ddc06695c0b and below e9096a5a170e7ecd6467bc2e08668ec39897cda7 is affected.
- Version 6.14 is affected.
- Before 6.14 is unaffected.
- Version 6.18.36, <= 6.18.* is unaffected.
- Version 7.0.13, <= 7.0.* is unaffected.
- Version 7.1, <= * is unaffected.