CVE-2026-63872

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A page fragment reference leak occurs in the esp output tail() function when esp->inplace is false. The issue arises during the replacement of old socket buffer (skb) page fragments with a new page from the xfrm page frag cache. If the second skb to sgvec() call, which is used to build the destination scatterlist from the new page, fails, the execution jumps to an error handler that only frees temporary memory via kfree(tmp). Consequently, the old page fragment references captured in the source scatterlist are not released, and kfree skb() only releases the new page. This flaw affects both esp4 and esp6 implementations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.