CVE-2026-63872 Overview
CVE-2026-63872 is a memory leak vulnerability in the Linux kernel's IPsec Encapsulating Security Payload (ESP) implementation. The flaw affects both the esp4 and esp6 modules, which share identical vulnerable code paths. When esp_output_tail() runs with esp->inplace set to false, the kernel replaces old skb page fragments with a new page from the xfrm page_frag cache. If the second skb_to_sgvec() call fails, the error path fails to release the old page fragment references captured in the source scatterlist. Repeated failures exhaust kernel memory, degrading system availability over time.
Critical Impact
Remote unauthenticated attackers can trigger a kernel page reference leak over the network, leading to memory exhaustion and denial of service on IPsec-enabled Linux hosts.
Affected Products
- Linux kernel esp4 module (IPv4 ESP transform)
- Linux kernel esp6 module (IPv6 ESP transform)
- Linux distributions shipping affected kernel versions with IPsec/XFRM enabled
Discovery Timeline
- 2026-07-19 - CVE-2026-63872 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-63872
Vulnerability Analysis
The vulnerability resides in the esp_output_tail() function within the Linux kernel's ESP output path. When performing non-inplace crypto transformations, the code builds a source scatterlist from the existing skb page fragments using skb_to_sgvec(), then replaces nr_frags with a single new page allocated from the xfrm page_frag cache. A second skb_to_sgvec() call constructs the destination scatterlist from this new page.
If the second skb_to_sgvec() call fails, control flows to the error_free label, which only executes kfree(tmp) to release the scatterlist memory. The old page fragment references captured in the source scatterlist are never released. Additionally, kfree_skb() frees only the replacement fragment at frag[0], not the original fragments now referenced solely by the abandoned source scatterlist.
Root Cause
The root cause is incomplete error handling in esp_ssg_unref(). The function normally checks req->src and req->dst to decide whether to unref source scatterlist fragments. At the point of the second skb_to_sgvec() failure, aead_request_set_crypt() has not yet initialized these fields, so esp_ssg_unref() skips releasing the captured references [CWE-401: Memory Leak].
Attack Vector
A remote attacker who can influence IPsec ESP output processing may induce conditions that cause skb_to_sgvec() to fail, such as crafted packet sequences that stress scatterlist construction. Each failure leaks references to old page fragments. Sustained triggering leads to memory exhaustion on the target host, producing a denial-of-service condition. Authentication is not required because ESP output processing occurs during normal kernel packet handling.
The upstream fix, committed in 2982e599fff6 and e705b8ff4dd3, adds a boolean parameter to esp_ssg_unref(). When set to true on the error path, it unconditionally unrefs the source scatterlist fragments without checking req->src and req->dst. Existing callers pass false to preserve original behavior.
Detection Methods for CVE-2026-63872
Indicators of Compromise
- Gradual, unexplained growth in kernel memory usage on IPsec gateways or hosts with active xfrm transforms
- Rising nr_frags and page allocator pressure correlated with ESP traffic volume
- Repeated crypto operation failures logged from the esp4 or esp6 modules
Detection Strategies
- Monitor /proc/meminfo and /proc/slabinfo for sustained increases in SUnreclaim and page cache counters on IPsec endpoints
- Correlate kernel warnings from net/ipv4/esp4.c and net/ipv6/esp6.c with IPsec session activity
- Track xfrm counters via ip xfrm state and ip -s xfrm policy for anomalous error rates
Monitoring Recommendations
- Baseline kernel memory consumption on VPN concentrators and hosts using ESP transforms, alerting on drift beyond normal operational range
- Ingest kernel logs into a centralized SIEM to correlate ESP subsystem errors with network events
- Track kernel package versions across the fleet to identify hosts still running unpatched kernels
How to Mitigate CVE-2026-63872
Immediate Actions Required
- Identify all Linux hosts using IPsec ESP transforms, including VPN gateways, site-to-site tunnels, and container hosts with xfrm policies
- Apply the upstream kernel patches referenced by commits 2982e599fff6 and e705b8ff4dd3 or update to a distribution kernel that includes these fixes
- Reboot affected systems after patching to ensure the corrected esp4 and esp6 modules are loaded
Patch Information
The fix is available in the Linux stable tree via commits 2982e599fff6 and e705b8ff4dd3. Both commits modify esp_ssg_unref() to accept a boolean that forces unconditional source scatterlist release on the error path. Consult your Linux distribution's security advisory channel for backported kernel packages.
Workarounds
- Where IPsec is not required, disable the esp4 and esp6 kernel modules and remove associated xfrm policies
- Restrict ESP traffic to trusted peers using firewall rules to reduce exposure to attacker-influenced packet flows
- Schedule periodic reboots on unpatched IPsec hosts to reclaim leaked memory as an interim measure
# Verify running kernel version and installed patches
uname -r
# Check whether esp4/esp6 modules are loaded
lsmod | grep -E '^esp[46]'
# Inspect active xfrm state and counters for anomalies
ip -s xfrm state
ip -s xfrm policy
# Disable ESP modules if IPsec is not required
echo 'blacklist esp4' | sudo tee /etc/modprobe.d/disable-esp.conf
echo 'blacklist esp6' | sudo tee -a /etc/modprobe.d/disable-esp.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
