CVE-2026-53363
published 2026-07-10CVE-2026-53363: In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags() iptfs_consume_frags()…
PriorityP345critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.29%
21.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
iptfs_consume_frags() transfers paged fragments from one socket buffer
to another but fails to propagate the SKBFL_SHARED_FRAG flag. This is
the same class of bug that was fixed in skb_try_coalesce() for
CVE-2026-46300: when fragments backed by read-only page-cache pages are
merged, the marker indicating their shared nature must be preserved so
that ESP can decide correctly whether in-place encryption is safe.
Apply the same two-line fix used in skb_try_coalesce() to
iptfs_consume_frags().
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 6.14 < 6.18.36 | 6.18.36 |
| linux | linux_kernel | >= 6.19 < 7.0.13 | 7.0.13 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
vendor_redhat·2026-07-10·CVSS 7.8
CVE-2026-53363 [HIGH] CWE-821 kernel: xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
kernel: xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
A flaw was found in the Linux kernel's `iptfs` component, part of the IPSec framework. The `iptfs_consume_frags()` function does not correctly propagate a flag indicating shared fragments. This can cause the Encapsulating Security Payload (ESP) to make incorrect security decisions regarding in-place encryption, potentially impacting the integrity or confidentiality of network traffic.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat
VulDB
Linux Kernel xfrm iptfs_consume_frags buffer overflow (Nessus ID 326373)
vuldb·2026-07-11·CVSS 7.8
CVE-2026-53363 [HIGH] Linux Kernel xfrm iptfs_consume_frags buffer overflow (Nessus ID 326373)
A vulnerability categorized as very critical has been discovered in Linux Kernel. Affected by this issue is the function iptfs_consume_frags of the component xfrm. The manipulation results in buffer overflow.
This vulnerability is reported as CVE-2026-53363. The attack can be launched remotely. No exploit exists.
GHSA
In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags() iptfs_consume_frags() transfers paged fragments from one socket
ghsa_unreviewed·2026-07-10·CVSS 7.8
CVE-2026-53363 [HIGH] In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags() iptfs_consume_frags() transfers paged fragments from one socket
In the Linux kernel, the following vulnerability has been resolved:
xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
iptfs_consume_frags() transfers paged fragments from one socket buffer
to another but fails to propagate the SKBFL_SHARED_FRAG flag. This is
the same class of bug that was fixed in skb_try_coalesce() for
CVE-2026-46300: when fragments backed by read-only page-cache pages are
merged, the marker indicating their shared nature must be preserved so
that ESP can decide correctly whether in-place encryption is safe.
Apply the same two-line fix used in skb_try_coalesce() to
iptfs_consume_frags().
No detection rules found.
No public exploits indexed.
2026-07-10
Published