CVE-2026-64566 is a vulnerability in Linux Kernel
Published on August 5, 2026
xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()
In the Linux kernel, the following vulnerability has been resolved:
xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()
When iptfs_skb_add_frags() copies frag references from the source
frag walk into a new SKB, it increments the page reference count via
__skb_frag_ref() but does not propagate SKBFL_SHARED_FRAG to the
destination SKB's skb_shinfo->flags.
If the source SKB carries shared frags (e.g. from a page-pool backed
receive path), the new inner SKB will appear to ESP as having privately
owned frags. A subsequent esp_input() call for a nested transport-mode
SA then takes the no-COW fast path and decrypts in place, writing over
pages that are still referenced by the outer IPTFS SKB. This causes
kernel-visible memory corruption and can trigger a panic.
All other frag-transfer helpers in the kernel (skb_try_coalesce,
skb_gro_receive, __pskb_copy_fclone, skb_shift, skb_segment) correctly
propagate SKBFL_SHARED_FRAG; align iptfs_skb_add_frags() with this
convention by setting the flag inside the loop immediately after
__skb_frag_ref() and nr_frags++, so every exit path that attaches a frag
unconditionally propagates SKBFL_SHARED_FRAG.
Products Associated with CVE-2026-64566
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7 and below d8aaf06b29f5a0b6186cf68d21c7d63678ee3891 is affected.
- Version 5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7 and below ffd64e0717efd83fbf3396ab4e5ac6d795dac4d0 is affected.
- Version 5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7 and below 430ea57d6daf765e88f90046afbfd1e071cb7200 is affected.
- Version 6.14 is affected.
- Before 6.14 is unaffected.
- Version 6.18.42, <= 6.18.* is unaffected.
- Version 7.1.6, <= 7.1.* is unaffected.
- Version 7.2-rc4, <= * is unaffected.