CVE-2026-53363

CriticalCVSS 9.8/10Last modified Jul 22, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()

iptfs_consume_frags() transfers paged fragments from one socket buffer to another but fails to propagate the SKBFL_SHARED_FRAG flag. This is the same class of bug that was fixed in skb_try_coalesce() for CVE-2026-46300: when fragments backed by read-only page-cache pages are merged, the marker indicating their shared nature must be preserved so that ESP can decide correctly whether in-place encryption is safe.

Apply the same two-line fix used in skb_try_coalesce() to iptfs_consume_frags().

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
LinuxLinux>= b96ba312e21c9b7ac1526829b9640ddc06695c0b, < dd66f7f6e360ee82cd905517726f8e9091265de5; >= b96ba312e21c9b7ac1526829b9640ddc06695c0b, < c885d111ed9f5a0a1f3cc4e87a50db6518abaa6c; >= b96ba312e21c9b7ac1526829b9640ddc06695c0b, < e9096a5a170e7ecd6467bc2e08668ec39897cda7
LinuxLinux6.14

References

Timeline

Published
Jul 10, 2026
Last modified
Jul 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-533645.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() hci_le_CVE-2026-533655.5In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zerocopy completion for multi-skb sends When a largeCVE-2026-533667.8In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In __ip_append_CVE-2026-533675.5In the Linux kernel, the following vulnerability has been resolved: selinux: fix avdcache auditing The per-task avdcache was incorrectly sCVE-2026-533687.1In the Linux kernel, the following vulnerability has been resolved: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage CVE-2026-533698.4In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udf_read_tagged() skCVE-2026-53376.5During the analysis, it was identified that authenticated attackers with Subscriber-level access or higher are able to perform an Insecure DCVE-2026-533705.5In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Improve validation and configuration of ACR masks CurrCVE-2026-533715.5In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: bound node_desc sysfs read with %.64s node_desc[64] in strCVE-2026-533725.5In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Block PASID attachment to nested domain with dirty trackingCVE-2026-533737.8In the Linux kernel, the following vulnerability has been resolved: mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap()CVE-2026-533748.8In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GART table on allocation GART TLB is flush
CVE-2026-53363: Critical severity, CVSS 9.8 | Vulnix