USN-8615-2: Linux kernel (Raspberry Pi) vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

SUSE CVE-2026-64009

In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrmstatemtu Leo Lin reported OOB write issue in esp component: xfrmstatemtu returns u32 but performs its arithmetic in unsigned modulo-2^32 space using an attacker-influenced "headerlen + authsize +...

Linux Distros Unpatched Vulnerability : CVE-2026-63912

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in espoutputhead before espoutputtail allocates the...

Linux Distros Unpatched Vulnerability : CVE-2026-64009

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfrm: Check for underflow in xfrmstatemtu Leo Lin reported OOB write issue in esp component: xfrmstatemtu returns u32 but performs its arithmetic in unsigned...

CVE-2026-64009

In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrmstatemtu Leo Lin reported OOB write issue in esp component: xfrmstatemtu returns u32 but performs its arithmetic in unsigned modulo-2^32 space using an attacker-influenced "headerlen + authsize +...

CVE-2026-63912

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in espoutputhead before espoutputtail allocates the destination page frag. The head-side gate currently checks skb-datalen and...

CVE-2026-64009

In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrmstatemtu Leo Lin reported OOB write issue in esp component: xfrmstatemtu returns u32 but performs its arithmetic in unsigned modulo-2^32 space using an attacker-influenced "headerlen + authsize +...

EUVD-2026-45582

In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrmstatemtu Leo Lin reported OOB write issue in esp component: xfrmstatemtu returns u32 but performs its arithmetic in unsigned modulo-2^32 space using an attacker-influenced "headerlen + authsize +...

CVE-2026-64009 xfrm: Check for underflow in xfrm_state_mtu

In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrmstatemtu Leo Lin reported OOB write issue in esp component: xfrmstatemtu returns u32 but performs its arithmetic in unsigned modulo-2^32 space using an attacker-influenced "headerlen + authsize +...

CVE-2026-64009

The CVE-2026-64009 family affects the Linux kernel xfrm subsystem, specifically an out-of-bounds write in ESP handling due to an underflow in xfrm_state_mtu(). The function computes using unsigned arithmetic: it subtracts attacker-influenced header_len + authsize + net_adj from a small mtu, allow...

CVE-2026-63912

The CVE concerns the Linux kernel XFRM/ESP path. The vulnerability arises in the ESP out-of-place fast path where an out-of-line trailer is written before dest page frag allocation; the head gate and tail code previously treated skb->data_len and tailen separately, risking an overflow when the...

CVE-2026-63912 xfrm: esp: restore combined single-frag length gate

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in espoutputhead before espoutputtail allocates the destination page frag. The head-side gate currently checks skb-datalen and...

CVE-2026-63912 xfrm: esp: restore combined single-frag length gate

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in espoutputhead before espoutputtail allocates the destination page frag. The head-side gate currently checks skb-datalen and...

EUVD-2026-45685

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in espoutputhead before espoutputtail allocates the destination page frag. The head-side gate currently checks skb-datalen and...

CVE-2026-63912

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in espoutputhead before espoutputtail allocates the destination page frag. The head-side gate currently checks skb-datalen and...

EUVD-2026-45557

In the Linux kernel, the following vulnerability has been resolved: esp: fix page frag reference leak on skbtosgvec failure In espoutputtail, when esp-inplace is false, the old skb page frags are replaced with a new page from the xfrm pagefrag cache. The source scatterlist sg is built from the ol...

CVE-2026-63872

In the Linux kernel, the following vulnerability has been resolved: esp: fix page frag reference leak on skbtosgvec failure In espoutputtail, when esp-inplace is false, the old skb page frags are replaced with a new page from the xfrm pagefrag cache. The source scatterlist sg is built from the ol...

CVE-2026-63872 esp: fix page frag reference leak on skb_to_sgvec failure

In the Linux kernel, the following vulnerability has been resolved: esp: fix page frag reference leak on skbtosgvec failure In espoutputtail, when esp-inplace is false, the old skb page frags are replaced with a new page from the xfrm pagefrag cache. The source scatterlist sg is built from the ol...

PT-2026-61189

In the Linux kernel, the following vulnerability has been resolved: esp: fix page frag reference leak on skb to sgvec failure In esp output tail, when esp-inplace is false, the old skb page frags are replaced with a new page from the xfrm page frag cache. The source scatterlist sg is built from t...

CVE-2026-53363

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: preserve shared-frag marker in iptfsconsumefrags iptfsconsumefrags transfers paged fragments from one socket buffer to another but fails to propagate the SKBFLSHAREDFRAG flag. This is the same class of bug that was...