Kernel Memory Corruption in Linux due to IPTFS Frag Reference Handling

CVE-2026-64566

What is CVE-2026-64566?

A vulnerability in the Linux kernel's processing of frag references in IPTFS can lead to kernel-visible memory corruption. The issue arises when the iptfs_skb_add_frags() function does not correctly propagate the SKBFL_SHARED_FRAG flag when copying fragment references. As a result, a newly created SKB may incorrectly appear to have privately owned fragments, which can trigger a panic when the esp_input() function processes a nested transport-mode Security Association (SA). This mismanagement of fragment references can lead to the overwriting of memory pages still being used by the outer IPTFS SKB, posing significant risks to system stability.

References