CVE-2026-64566: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64566 Overview

CVE-2026-64566 is a Linux kernel vulnerability in the xfrm IP-TFS (IP Traffic Flow Security) implementation. The function iptfs_skb_add_frags() copies fragment references from a source SKB into a new SKB and calls __skb_frag_ref(), but fails to propagate the SKBFL_SHARED_FRAG flag to the destination SKB's skb_shinfo->flags. Downstream code in esp_input() then treats the shared fragments as privately owned and takes a no-copy-on-write fast path, decrypting in place over memory still referenced by the outer IPTFS SKB. The result is kernel memory corruption that can trigger a panic.

Critical Impact
In-place ESP decryption overwrites live page-pool pages, producing kernel-visible memory corruption and potential system panic on hosts processing nested transport-mode IPsec traffic over IPTFS.

Affected Products

Linux kernel versions containing the xfrm IPTFS iptfs_skb_add_frags() implementation prior to the fix commits
Systems using IPsec IP-TFS with nested transport-mode Security Associations
Networking stacks receiving traffic on page-pool backed drivers that produce shared frags

Discovery Timeline

2026-08-05 - CVE-2026-64566 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-64566

Vulnerability Analysis

The defect is a kernel memory corruption issue [CWE-787-class behavior] in the net/xfrm/xfrm_iptfs.c fragment handling path. When IPTFS reassembles inner packets, iptfs_skb_add_frags() walks the source SKB's fragment array and attaches page references to a newly constructed inner SKB. The reference count is incremented correctly via __skb_frag_ref(), but the metadata flag SKBFL_SHARED_FRAG on skb_shinfo(dst)->flags is never set. Every other kernel helper that transfers frags — skb_try_coalesce, skb_gro_receive, __pskb_copy_fclone, skb_shift, and skb_segment — propagates this flag. The IPTFS path diverged from that convention.

Root Cause

The root cause is missing state propagation. SKBFL_SHARED_FRAG signals to downstream consumers that fragment pages may be referenced by other SKBs and must not be modified in place. Without this flag, the inner SKB looks like it owns its pages exclusively. When the inner SKB is then handed to esp_input() for a nested transport-mode Security Association, ESP evaluates ownership and selects the no-COW fast path, decrypting ciphertext directly into the shared pages. Those same pages remain reachable through the outer IPTFS SKB and other consumers of the page-pool backed receive buffer.

Attack Vector

An attacker who can deliver crafted IPsec traffic through an IPTFS tunnel to a target performing nested transport-mode decryption can trigger the in-place decryption over shared pages. The corruption is deterministic under the required configuration and can cause a kernel panic, producing denial of service. Exploitation depends on the presence of an IPTFS tunnel, a nested transport-mode SA, and a receive path that produces page-pool backed shared frags.

No verified public exploit code is available. The vulnerability mechanism is documented in the upstream commit messages referenced below.

Detection Methods for CVE-2026-64566

Indicators of Compromise

Unexpected kernel panics or oopses referencing esp_input, xfrm_input, iptfs, or SKB shared info handling in stack traces
Corrupted inner packets or authentication failures on nested transport-mode IPsec SAs terminated over an IPTFS tunnel
Increased XfrmInStateProtoError or ESP integrity failures visible via ip -s xfrm state on hosts running affected kernels

Detection Strategies

Inventory kernel versions across Linux fleets and correlate against the fix commits 430ea57, d8aaf06, and ffd64e07 to identify unpatched hosts
Monitor kernel ring buffer (dmesg) for panics or warnings referencing skb_shinfo, __skb_frag_ref, iptfs, or esp_input
Flag hosts that combine IPTFS tunnels with additional transport-mode SAs, since only that configuration reaches the vulnerable path

Monitoring Recommendations

Centralize kernel crash dumps and kdump output for review after IPsec-related outages
Track /proc/net/xfrm_stat counters over time and alert on sustained anomalies
Capture host telemetry into a central data lake so kernel version, IPsec configuration, and crash events can be correlated across the fleet

How to Mitigate CVE-2026-64566

Immediate Actions Required

Apply the upstream Linux kernel fix that sets SKBFL_SHARED_FRAG on the destination SKB inside the iptfs_skb_add_frags() loop immediately after __skb_frag_ref() and nr_frags++
Update to a distribution kernel that incorporates commits 430ea57d6daf, d8aaf06b29f5, and ffd64e0717ef
Reboot affected hosts after upgrade so the new kernel image is active

Patch Information

The fix aligns iptfs_skb_add_frags() with every other frag-transfer helper in the kernel by unconditionally propagating SKBFL_SHARED_FRAG on any exit path that attaches a fragment. Reference commits: Kernel Git Commit 430ea57, Kernel Git Commit d8aaf06, and Kernel Git Commit ffd64e07.

Workarounds

Disable IPTFS mode on affected xfrm policies until the kernel is patched
Avoid stacking a transport-mode Security Association inside an IPTFS tunnel on unpatched hosts, since the vulnerable path requires nested decryption
Where feasible, switch affected receive interfaces to drivers or configurations that do not use page-pool backed shared frags

bash

# Confirm the running kernel and inspect IPsec/IPTFS configuration on a Linux host
uname -r
ip xfrm policy | grep -i iptfs
ip xfrm state | grep -E 'mode (transport|iptfs)'