CVE-2026-64566

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the xfrm iptfs component where the iptfs skb add frags() function fails to propagate the SKBFL SHARED FRAG flag to the destination SKB's skb shinfo->flags when copying fragment references. If the source SKB contains shared fragments, the resulting inner SKB is incorrectly identified as having privately owned fragments. Consequently, a subsequent esp input() call for a nested transport-mode SA may utilize a no-COW (Copy-on-Write) fast path to decrypt data in place. This process overwrites pages still referenced by the outer IPTFS SKB, leading to kernel-visible memory corruption and potential system panics.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.