CVE-2026-63912

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the xfrm ESP out-of-place fast path where the esp output head() function appends the trailer before esp output tail() allocates the destination page frag. The head-side gate incorrectly checks skb->data len and tailen separately, whereas the tail code allocates a single destination frag based on the combined post-trailer skb->data len. This can cause skb page frag refill() to fall back to a single page while the destination scatter-gather (sg) list still spans the combined skb->data len if the combined aligned length exceeds a page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.