{"id":"CVE-2026-98368","published":"2026-10-06T09:18:31.130","lastModified":"2026-10-07T07:17:11.260","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nesp: downgrade zerocopy managed frags before mutating skb frags\n\nOn the out-of-place output path (esp->inplace == false) ESP rewrites the\nskb frag array: esp_output_head() appends a trailer frag and\nesp_output_tail() replaces the frags with a destination page, both\nreferenced with get_page().\n\nWhen the skb carries zerocopy managed frags (SKBFL_MANAGED_FRAG_REFS) the\npayload frags are owned by the ubuf and must not be referenced or\nunreferenced individually, but ESP mutates the frag array without ever\ndowngrading the skb.  This breaks the managed-frag invariant two ways:\n\n  - esp_ssg_unref() walks the source scatterlist and drops a page\n    reference for every frag, including the ubuf-owned payload frags,\n    pushing their refcount below the GUP pin bias while the pages are\n    still pinned, i.e. a use-after-free of the zerocopy pages;\n\n  - esp_output_tail() installs its destination page as frag 0 with\n    get_page() but leaves SKBFL_MANAGED_FRAG_REFS set, so\n    skb_release_data() takes the skip_unref branch and never drops that\n    reference, leaking the x->xfrag page at packet rate.\n\nFix this the way every other frag-mutating site does (__ip_append_data(),\n__ip6_append_data(), tcp_sendmsg_locked()) and call\nskb_zcopy_downgrade_managed() before ESP touches the frag array: it takes\na real reference on each existing frag and clears SKBFL_MANAGED_FRAG_REFS,\nso the per-frag unref in esp_ssg_unref() and the frag release in\nskb_release_data() are both balanced and no mixed-ownership frag array is\nleft behind.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/0d0845ee61c5df47cc68bc446501f48f71e8dcc6","tags":[]},{"url":"https://git.kernel.org/stable/c/2359264f377cdbdef2d95868cc8fb572949e48d3","tags":[]},{"url":"https://git.kernel.org/stable/c/6508304ac2c8cdafca2f4ab915df8c707893e134","tags":[]},{"url":"https://git.kernel.org/stable/c/69a768c12398cada8528080332c822623fa7064d","tags":[]},{"url":"https://git.kernel.org/stable/c/6cab554f2c0f28773f712ed3a5479103f42ce844","tags":[]},{"url":"https://git.kernel.org/stable/c/f89416eb3db151170a6f3c6dfc5239d26cdce4d2","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Linux kernel's ESP (Encapsulating Security Payload) implementation fails to properly handle zerocopy managed fragments, leading to potential use-after-free conditions and memory leaks when processing network packets. This occurs because ESP mutates fragment arrays without downgrading managed fragment references, breaking critical invariants that protect zero-copy page management.","exploitability":"Exploitation is moderately difficult and requires specific conditions including the use of zerocopy managed fragments with ESP encryption, but does not require user interaction or privilege escalation.","blast_radius":"The vulnerability could affect network-intensive applications using ESP encryption, potentially causing system instability, memory corruption, or denial of service through memory leaks and use-after-free conditions in kernel memory management.","remediation":"Apply the kernel patch that implements skb_zcopy_downgrade_managed() before ESP modifies fragment arrays, specifically targeting the fix for CVE-2026-98368 which addresses the zerocopy managed frag handling in ESP output processing.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["kernel","network","memory-corruption","esp"],"model":"garnet-coder","analyzedAt":"2026-10-14T09:02:10.848Z"}}