CVE-2026-63912: Linux Kernel Privilege Escalation Flaw

CVE-2026-63912 Overview

CVE-2026-63912 is a Linux kernel vulnerability in the xfrm Encapsulating Security Payload (ESP) out-of-place fast path. The flaw exists because esp_output_head() appends the trailer before esp_output_tail() allocates the destination page frag. The head-side gate checks skb->data_len and tailen separately, while the tail code allocates a single destination frag from the combined post-trailer skb->data_len. When the combined aligned length exceeds a page, skb_page_frag_refill() may fall back to a single page while the destination scatter-gather list still spans the combined skb->data_len, causing memory corruption in the IPsec ESP path for both IPv4 and IPv6.

Critical Impact
Network-reachable memory corruption in the Linux kernel IPsec ESP output path affecting both IPv4 and IPv6 traffic handling.

Affected Products

Linux kernel xfrm subsystem (ESP IPv4 output path)
Linux kernel xfrm subsystem (ESP IPv6 output path)
Systems using IPsec with ESP encapsulation on affected kernel versions

Discovery Timeline

2026-07-19 - CVE-2026-63912 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63912

Vulnerability Analysis

The vulnerability resides in the ESP output fast path used by the Linux kernel xfrm framework. The ESP output is split into two stages: esp_output_head() prepares the packet and appends the ESP trailer, and esp_output_tail() finalizes the packet by allocating a destination page fragment for encrypted output. The two stages disagree on how packet length is measured.

esp_output_head() evaluates the fast-path eligibility gate using skb->data_len and tailen as separate quantities. esp_output_tail(), however, allocates a single destination fragment sized from the combined post-trailer skb->data_len. When the aligned combined length crosses a page boundary, skb_page_frag_refill() may return a single page insufficient to hold the full destination scatter-gather range, producing an out-of-bounds condition during ESP encryption.

Root Cause

The root cause is an inconsistent length check between the head and tail stages of the ESP out-of-place fast path. The fix restores a combined-length page gate so the eligibility check reflects the same total length used by the tail allocation. The patch applies to both IPv4 and IPv6 ESP output paths.

Attack Vector

An attacker on the network can send crafted traffic through an IPsec tunnel to trigger the length mismatch in the ESP output path. Exploitation does not require authentication or user interaction and targets kernel memory backing the destination scatter-gather list.

The vulnerability manifests in the ESP out-of-place fast path where
esp_output_head() and esp_output_tail() use inconsistent length
measurements. See the upstream commits referenced below for the
exact fix.

Detection Methods for CVE-2026-63912

Indicators of Compromise

Unexpected kernel warnings or oopses referencing esp_output_tail, esp_output_head, or skb_page_frag_refill in dmesg and /var/log/kern.log.
IPsec tunnel instability, sudden ESP SA (Security Association) resets, or increased packet loss on tunnels carrying near-MTU traffic.
Kernel memory corruption panics on hosts terminating IPsec ESP traffic.

Detection Strategies

Inventory Linux hosts running kernel versions predating the referenced stable commits and cross-reference against IPsec-enabled systems.
Monitor kernel ring buffer for stack traces in xfrm or esp4/esp6 modules during periods of high ESP traffic.
Alert on repeated ESP encapsulation errors in /proc/net/xfrm_stat.

Monitoring Recommendations

Enable kernel crash dump capture (kdump) on IPsec gateways to preserve forensic state after a fault.
Track kernel version and package inventory continuously to identify hosts missing the stable patch.
Correlate network telemetry with host kernel logs to detect crafted ESP traffic patterns preceding faults.

How to Mitigate CVE-2026-63912

Immediate Actions Required

Apply the upstream Linux kernel stable patches referenced in the Linux kernel commit tree and rebuild or update to a fixed stable kernel.
Identify all IPsec gateways, VPN concentrators, and hosts terminating ESP traffic and prioritize them for patching.
Restart affected systems after applying the kernel update so the new xfrm code path is loaded.

Patch Information

The fix restores the combined single-fragment length gate in the ESP output fast path for both IPv4 and IPv6. Reference commits include 322e48187e02, 36519e3d941f, 566295735530, 5d7ab86e2b6b, 65f3b3fc2347, b84091ceddc9, c093468aea82, and dfa0d7b0ff1e.

Workarounds

Where patching is not immediately feasible, restrict ESP traffic to trusted peers using firewall rules and IKE authentication policies.
Reduce path MTU or negotiate smaller ESP payload sizes on tunnels to avoid triggering the combined-length page boundary condition.
Disable non-essential IPsec ESP tunnels until the kernel update is deployed.

bash

# Verify running kernel version and reboot after patch installation
uname -r
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-$(uname -r | sed 's/-generic//')
sudo systemctl reboot