CVE-2026-53363

xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()

Critical · published July 10, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
23.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()

iptfs_consume_frags() transfers paged fragments from one socket buffer

to another but fails to propagate the SKBFL_SHARED_FRAG flag. This is

the same class of bug that was fixed in skb_try_coalesce() for

CVE-2026-46300: when fragments backed by read-only page-cache pages are

merged, the marker indicating their shared nature must be preserved so

that ESP can decide correctly whether in-place encryption is safe.

Apply the same two-line fix used in skb_try_coalesce() to

iptfs_consume_frags().

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00319 · 23.7th percentile
Published
2026-07-10T11:55Z
EPSS history
Timeline
  • 10 JUL 11:55Z
    xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
    cvelistv5