Linux Kernel Vulnerability Impacting Managed Frags in ESP Functionality

CVE-2026-98368

What is CVE-2026-98368?

In the Linux kernel, a vulnerability has been identified with the ESP functionality, specifically related to the management of zerocopy fragments. When handling out-of-place output paths (where esp->inplace is false), the ESP process mutates the skb frag array incorrectly by appending and replacing frags without properly downgrading the skb. This mishandling can lead to a use-after-free scenario, impacting managed-frag invariants and causing potential memory leaks. The issue arises as esp_ssg_unref() improperly drops references on ubuf-owned payload frags, while esp_output_tail() adds destination pages without clearing relevant flags, leading to instability and vulnerabilities that can be exploited in packet processing.

References