CVE-2026-63872 Linux CVE debrief

Who should care

Linux kernel users and administrators should be aware of this vulnerability and ensure their systems are updated with the fix. They should review the official advisory to validate affected scope, severity, and vendor guidance. Affected operator, platform, vulnerability-management, and security-team impact should be carefully evaluated.

Technical summary

The Linux kernel vulnerability CVE-2026-63872 is related to the ESP (Encapsulating Security Payload) component. In the esp_output_tail() function, when esp->inplace is false, the old skb page frags are replaced with a new page from the xfrm page_frag cache. The source scatterlist (sg) is built from the old frags before replacement. However, if the second skb_to_sgvec() call fails, the code jumps to error_free, which only calls kfree(tmp). The old page frag references captured in the source scatterlist are never released. The fix involves adding a bool parameter to esp_ssg_unref() that, when true, unconditionally unrefs the source scatterlist frags without checking req->src and req->dst.

Defensive priority

Medium

Recommended defensive actions

• Update Linux kernel to the latest version
• Review and apply the fix for esp_output_tail()
• Monitor system for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-19T15:16:54.247Z and has not been modified since then. The NVD entry is currently Received. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the official advisory. The fix involves adding a bool parameter to esp_ssg_unref() to unconditionally release source scatterlist frags on error. Linux kernel users and administrators should review the official advisory for more information.

Official resources