Description

In the Linux kernel, the following vulnerability has been resolved: esp: downgrade zerocopy managed frags before mutating skb frags On the out-of-place output path (esp->inplace == false) ESP rewrites the skb frag array: esp_output_head() appends a trailer frag and esp_output_tail() replaces the frags with a destination page, both referenced with get_page(). When the skb carries zerocopy managed frags (SKBFL_MANAGED_FRAG_REFS) the payload frags are owned by the ubuf and must not be referenced or unreferenced individually, but ESP mutates the frag array without ever downgrading the skb. This breaks the managed-frag invariant two ways: - esp_ssg_unref() walks the source scatterlist and drops a page reference for every frag, including the ubuf-owned payload frags, pushing their refcount below the GUP pin bias while the pages are still pinned, i.e. a use-after-free of the zerocopy pages; - esp_output_tail() installs its destination page as frag 0 with get_page() but leaves SKBFL_MANAGED_FRAG_REFS set, so skb_release_data() takes the skip_unref branch and never drops that reference, leaking the x->xfrag page at packet rate. Fix this the way every other frag-mutating site does (__ip_append_data(), __ip6_append_data(), tcp_sendmsg_locked()) and call skb_zcopy_downgrade_managed() before ESP touches the frag array: it takes a real reference on each existing frag and clears SKBFL_MANAGED_FRAG_REFS, so the per-frag unref in esp_ssg_unref() and the frag release in skb_release_data() are both balanced and no mixed-ownership frag array is left behind.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-10-06T09:18:31.130Z",
  "pubdate": "2026-10-06T09:18:31.130Z",
  "executiveSummary": "A critical memory management vulnerability exists within the Linux kernel's ESP (Encapsulating Security Payload) output path when handling zerocopy managed fragments.\nThe vulnerability stems from the kernel's failure to downgrade managed zerocopy references before mutating the socket buffer (skb) fragment array.\nThis leads to an inconsistency in reference counting, resulting in both Use-After-Free (UAF) scenarios and persistent memory leaks.\nImpact includes potential kernel panic, system instability, and the risk of arbitrary memory access if an attacker can trigger the UAF condition successfully.\nThe issue affects systems utilizing ESP with zerocopy-enabled networking stacks.\nSuccessful exploitation requires the ability to trigger ESP out-of-place processing on zerocopy-managed packets, typically occurring during high-throughput network traffic processing.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper handling of the SKBFL_MANAGED_FRAG_REFS flag within the ESP (IPsec) output path (esp_output_head and esp_output_tail).\nWhen an skb carries zerocopy-managed fragments, the payload pages are owned by a ubuf structure, and individual fragments must not be manipulated directly. However, the ESP code modifies the fragment array without downgrading the managed state, violating the internal kernel invariant.\nAttack flow for Use-After-Free: When esp_ssg_unref() is called, it iterates over the scatterlist and performs an individual reference decrement on each fragment. Because the managed payload fragments are still tied to the ubuf, this action artificially lowers their reference count below the GUP (Get User Pages) pin bias. This causes the kernel to release pages that are still actively pinned, resulting in a classic Use-After-Free condition when the system subsequently attempts to access the freed memory.\nAttack flow for memory leaks: In the esp_output_tail() function, a new destination page (x->xfrag) is installed as fragment 0 using get_page(). Because the code fails to clear the SKBFL_MANAGED_FRAG_REFS flag, the subsequent call to skb_release_data() incorrectly enters the skip_unref branch. This skips the necessary cleanup for the newly added page, leading to a permanent kernel memory leak that scales linearly with packet throughput.\nExploitation involves injecting traffic that forces the kernel into the ESP out-of-place (esp->inplace == false) processing path while ensuring the skb is flagged for zerocopy. By forcing these conditions, an attacker can induce kernel memory corruption or resource exhaustion.\nThis vulnerability persists because the ESP implementation did not adhere to the pattern established in other kernel network subsystems (such as __ip_append_data, __ip6_append_data, and tcp_sendmsg_locked) which mandate the use of skb_zcopy_downgrade_managed() prior to any structural modification of the fragment array. This function ensures that standard reference counting is restored and the managed-fragment flag is cleared, preventing both the UAF and the leak."
}