What breaks and who should care
If you run a Linux host that handles IPsec traffic over UDP, a newly disclosed kernel flaw could allow an attacker to corrupt memory during decryption. The vulnerability is identified as CVE-2026-43284 and carries a CVSS score of 8.8, classed as high severity. Any system that processes ESP‑in‑UDP packets – for example, VPN gateways, cloud‑hosted routers or any server with strongSwan, Libreswan or similar IPsec stacks – needs to verify whether it is affected and apply the fix immediately.
We keep a daily-updated list of vulnerabilities CISA has confirmed as actively exploited, including remediation deadlines.
Technical summary
The kernel’s networking code builds packets in skb (socket buffer) structures. When data is received from a pipe, the function MSG_SPLICE_PAGES can attach the pipe’s pages directly to the skb without copying them first. For TCP this is safe because the kernel marks such buffers with the flag SKBFL_SHARED_FRAG, signalling that the data is shared and must be copied before any write‑back.
Unfortunately the same flag is not set for UDP packets that carry ESP payloads. The ESP input routine assumes the buffer is private and takes a fast‑path that decrypts the payload “in‑place”. When the buffer actually points to shared pages, the in‑place decryption overwrites memory that belongs to another process or to the kernel itself. The result is a classic use‑after‑free / write‑where‑condition that can lead to privilege escalation or kernel panic.
In short, the flaw is a missing “copy‑on‑write” guard for a specific class of non‑linear skbs. The fix adds the missing flag for UDP splices and forces the ESP input path to call skb_cow_data() whenever the flag is present, ensuring a private copy is made before decryption.
How to tell if you are exposed
First, confirm the kernel branch you are running. The simplest way is to ask the kernel directly:
uname -rcat /proc/version
Next, compare the reported branch against the table below. If your branch appears in any of the “affected” ranges, you are vulnerable until you move to the corresponding patched release.
Because the vulnerability only matters for code paths that handle ESP‑in‑UDP, you can also check whether those modules are loaded:
lsmod | grep xfrmmodinfo esp4(oresp6)
If the modules are present and your kernel version falls in an affected range, you should treat the host as at risk.
Immediate mitigations
While you arrange for a kernel update, you can reduce the attack surface with a few practical steps:
- Disable ESP‑in‑UDP if it is not required. Edit your IPsec configuration to use plain ESP over TCP or to force NAT‑traversal to use the default UDP port only when absolutely needed.
- Restrict which users can create raw sockets or manipulate netfilter rules that could trigger the vulnerable path. Ensure only trusted administrators have those capabilities.
- Enable SELinux or AppArmor confinement for the VPN daemon. Even if the kernel is compromised, mandatory access controls can limit what the attacker can do afterwards.
These mitigations do not remove the bug; they merely make it harder for an attacker to reach the vulnerable code.
Applying the fix
The vulnerability is patched in the kernel releases listed in the table below. The recommended action is to upgrade to the patched kernel for the branch you are on. How you do that depends on your distribution:
- On Debian‑based systems:
sudo apt update && sudo apt install linux-image-generic. The package manager will pull the newest kernel that includes the fix for your series. - On RHEL‑derived systems:
sudo yum update kernelorsudo dnf update kernelfor newer releases. - On SUSE:
sudo zypper update kernel-default.
After the install, reboot into the new kernel. Verify the running version again with uname -r and confirm it no longer appears in any of the affected ranges.
If a patched kernel is not yet available for your platform
Some specialised or long‑term support distributions may lag behind the upstream release. In that case you have two options:
- Back‑port the fix yourself. The patch consists of two changes: setting
SKBFL_SHARED_FRAGfor UDP splices and adding a guard in the ESP input path that forcesskb_cow_data()when the flag is present. The diff is published in the upstream kernel source tree; you can apply it to your kernel source and rebuild. - Temporarily disable the vulnerable feature. Adding
net.ipv4.ipfrag_high_thresh=0(or the equivalent sysctl for IPv6) does not stop ESP‑in‑UDP but can stop the specific splice path in many setups. Test carefully – this may impact performance.
Both approaches require a good understanding of kernel compilation and testing. If you are not comfortable with that, isolate the host from any untrusted network until a vendor‑supplied update appears.
What the severity means for you
A CVSS score of 8.8 indicates a high likelihood of successful exploitation and a serious impact on confidentiality, integrity and availability. An attacker who can send crafted ESP‑in‑UDP packets to a vulnerable host could gain kernel‑level code execution, effectively taking full control of the system. Because the bug is triggered during normal packet processing, an exploit does not need special privileges – any network entity that can reach the service can attempt it.
Given the ease of reaching a VPN gateway from the internet, the risk is non‑trivial. The safest stance is to treat every affected host as compromised until the kernel is updated.
Summary of actions
- Check your kernel version with
uname -rorcat /proc/version. - Cross‑reference the version against the table below. If you fall in an affected range, you are vulnerable.
- Upgrade the kernel using your distro’s package manager to the first patched release for your branch.
- Reboot and verify the new version.
- If you cannot upgrade, either back‑port the patch or disable ESP‑in‑UDP where possible.
- Apply host‑level hardening (SELinux/AppArmor, restricted raw‑socket access) as a temporary mitigation.
References
The official NVD entry provides the full list of affected and fixed kernel releases. The kernel commit that addresses the issue is publicly available in the mainline source tree. For distribution‑specific guidance, consult your vendor’s security advisory page.
Table of affected and fixed kernel releases
The table below lists the kernel branches that are vulnerable and the first release that contains the fix. Use it to verify whether your system needs an upgrade.
Affected versions
Straight from the NVD record for CVE-2026-43284. If your build is inside one of these ranges, treat it as vulnerable.
| Product | Affected range | Fixed in |
|---|---|---|
linux_kernel |
4.11 up to 5.10.255 | 5.10.255 |
linux_kernel |
5.12 up to 5.15.205 | 5.15.205 |
linux_kernel |
5.16 up to 6.1.171 | 6.1.171 |
linux_kernel |
6.2 up to 6.6.138 | 6.6.138 |
linux_kernel |
6.7 up to 6.12.87 | 6.12.87 |
linux_kernel |
6.13 up to 6.18.28 | 6.18.28 |
linux_kernel |
7.0 up to 7.0.5 | 7.0.5 |
