CVE-2026-64566

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()<br /> <br /> When iptfs_skb_add_frags() copies frag references from the source<br /> frag walk into a new SKB, it increments the page reference count via<br /> __skb_frag_ref() but does not propagate SKBFL_SHARED_FRAG to the<br /> destination SKB&amp;#39;s skb_shinfo-&gt;flags.<br /> <br /> If the source SKB carries shared frags (e.g. from a page-pool backed<br /> receive path), the new inner SKB will appear to ESP as having privately<br /> owned frags. A subsequent esp_input() call for a nested transport-mode<br /> SA then takes the no-COW fast path and decrypts in place, writing over<br /> pages that are still referenced by the outer IPTFS SKB. This causes<br /> kernel-visible memory corruption and can trigger a panic.<br /> <br /> All other frag-transfer helpers in the kernel (skb_try_coalesce,<br /> skb_gro_receive, __pskb_copy_fclone, skb_shift, skb_segment) correctly<br /> propagate SKBFL_SHARED_FRAG; align iptfs_skb_add_frags() with this<br /> convention by setting the flag inside the loop immediately after<br /> __skb_frag_ref() and nr_frags++, so every exit path that attaches a frag<br /> unconditionally propagates SKBFL_SHARED_FRAG.