CVE-2026-63912: Linux

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in esp_output_head() before esp_output_tail() allocates the destination page frag. The head-side gate currently checks skb->data_len and tailen separately, but the tail code allocates a single destination frag from the combined post-trailer skb->data_len. Reject the page-frag fast path when the combined aligned length exceeds a page. Otherwise skb_page_frag_refill() may fall back to a single page while the destination sg still spans the combined skb->data_len. Restore this combined-length page gate for both IPv4 and IPv6.

Affected products

• Linux Linux: from 5.10.113, before 5.10.259 (fixed in 5.10.259); from 5.15.36, before 5.15.210 (fixed in 5.15.210); from 4.14.288, before 4.15 (fixed in 4.15); from 4.19.252, before 4.20 (fixed in 4.20); from 5.4.205, before 5.5 (fixed in 5.5); from 5.17.5, before 5.18 (fixed in 5.18); …

Published 2026-07-19. Last modified 2026-07-27.