CVE-2026-52932 Overview
CVE-2026-52932 is a memory leak vulnerability in the Linux kernel's xfrm IPsec subsystem, specifically within the IP Payload Compression Protocol (IPComp) implementation. The flaw resides in the asynchronous compression (acomp) error handling path, where the allocated destination scatter-gather (SG) list pages were not freed when an error occurred. The fix moves the out_free_req label upward so that the destination SG list is released on both error and success paths. Repeated triggering of the error path can exhaust kernel memory over time, affecting systems that process IPsec traffic with payload compression enabled.
Critical Impact
Repeated acomp errors during IPComp processing can leak destination SG list pages, leading to kernel memory exhaustion and potential denial of service on hosts handling IPsec traffic.
Affected Products
- Linux kernel versions containing the unpatched xfrm IPComp acomp handling code
- Linux distributions shipping affected stable kernel branches
- Systems with IPsec IPComp transformations enabled
Discovery Timeline
- 2026-06-24 - CVE-2026-52932 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-52932
Vulnerability Analysis
The vulnerability exists in the Linux kernel xfrm IPComp transform code. IPComp uses asynchronous compression APIs (acomp) to compress and decompress IPsec payloads. During processing, the code allocates a destination scatter-gather (SG) list to hold compressed or decompressed pages.
The out_free_req label, which handles cleanup of the request and the allocated destination pages, was positioned such that the destination SG list pages were freed only on the success path. When acomp returned an error before reaching the cleanup label, the destination pages remained allocated. Each failed compression or decompression operation leaked memory pages held by the SG list. Sustained errors gradually consume kernel memory, which can degrade system performance or trigger out-of-memory conditions.
Root Cause
The root cause is incorrect placement of the cleanup label in the acomp error handling flow. The destination SG list allocation was not paired with an unconditional free on the error path, resulting in a memory leak each time the asynchronous compression operation failed before reaching success cleanup.
Attack Vector
Triggering the leak requires conditions that cause acomp operations to fail during IPComp processing. An adversary able to send malformed compressed IPsec payloads, or to induce resource pressure that causes acomp failures, can repeatedly invoke the faulty error path. Sustained triggering exhausts available kernel memory on hosts terminating or forwarding IPsec traffic with compression enabled.
No verified exploit code is publicly available. The vulnerability is described in the upstream kernel commit references provided by kernel.org. See the Kernel.org Commit Changes for the source-level fix.
Detection Methods for CVE-2026-52932
Indicators of Compromise
- Steady, unexplained growth in kernel slab or page allocations on hosts running IPsec with IPComp enabled
- Repeated errors logged by the xfrm subsystem during compression or decompression
- Out-of-memory events on systems that terminate or forward IPsec traffic
Detection Strategies
- Monitor /proc/meminfo and /proc/slabinfo for sustained growth correlated with IPsec traffic volume
- Review kernel ring buffer output via dmesg for xfrm or IPComp error messages
- Compare running kernel version against patched stable branches referenced in the kernel.org commits
Monitoring Recommendations
- Track per-host kernel memory consumption over time and alert on abnormal upward trends
- Capture and inspect IPsec error counters via ip -s xfrm state for elevated error rates
- Centralize host telemetry and kernel logs in a SIEM for long-term trend analysis across the fleet
How to Mitigate CVE-2026-52932
Immediate Actions Required
- Inventory Linux hosts running IPsec with IPComp enabled and identify those on unpatched kernel versions
- Apply the upstream kernel fix or update to a distribution kernel that includes the patch
- Where patching is not immediately feasible, evaluate disabling IPComp transformations until the update is deployed
Patch Information
The fix is published in the upstream Linux stable tree. Refer to the kernel.org commits: Kernel.org Commit 7dbac768, Kernel.org Commit b30aa173, and Kernel.org Commit dc6dcba8. The patch repositions the out_free_req label so that the destination SG list is freed on both success and error paths. Apply the kernel update from your distribution vendor as soon as it becomes available.
Workarounds
- Disable IPComp on IPsec security associations where compression is not required
- Restrict IPsec peers to trusted endpoints to reduce exposure to malformed compressed payloads
- Reboot affected hosts periodically to reclaim leaked kernel memory until a patched kernel can be deployed
# Inspect IPsec state and IPComp usage; remove IPComp transformations if not required
ip -s xfrm state
ip xfrm state flush
# Reconfigure SAs without the comp proto in your IPsec policy manager (e.g., strongSwan, Libreswan)
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
