{"id":4646,"date":"2026-09-04T18:46:40","date_gmt":"2026-09-04T10:46:40","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-64566"},"modified":"2026-09-04T18:46:40","modified_gmt":"2026-09-04T10:46:40","slug":"cve-2026-64566","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-64566","title":{"rendered":"CVE-2026-64566 [CRITICAL] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: iptfs: propagat"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()<\/p>\n<p>When iptfs_skb_add_frags() copies frag references from the source<br \/>\nfrag walk into a new SKB, it increments the page reference count via<br \/>\n__skb_frag_ref() but does not propagate SKBFL_SHARED_FRAG to the<br \/>\ndestination SKB&#8217;s skb_shinfo-&gt;flags.<\/p>\n<p>If the source SKB carries shared frags (e.g. from a page-pool backed<br \/>\nreceive path), the new inner SKB will appear to ESP as having privately<br \/>\nowned frags.  A subsequent esp_input() call for a nested transport-mode<br \/>\nSA then takes the no-COW fast path and decrypts in place, writing over<br \/>\npages that are still referenced by the outer IPTFS SKB.  This causes<br \/>\nkernel-visible memory corruption and can trigger a panic.<\/p>\n<p>All other frag-transfer helpers in the kernel (skb_try_coalesce,<br \/>\nskb_gro_receive, __pskb_copy_fclone, skb_shift, skb_segment) correctly<br \/>\npropagate SKBFL_SHARED_FRAG; align iptfs_skb_add_frags() with this<br \/>\nconvention by setting the flag inside the loop immediately after<br \/>\n__skb_frag_ref() and nr_frags++, so every exit path that attaches a frag<br \/>\nunconditionally propagates SKBFL_SHARED_FRAG.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()<\/p>\n<p>When iptfs_skb_add_frags() copies frag references from the sourc<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-4646","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/4646","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4646"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4646"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4646"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}