CVE-2026-52935: Linux Kernel espintcp Memory-Safety Vulnerability (CWE-787)

Technical summary

CVE-2026-52935 addresses a use-after-free condition in the Linux kernel's xfrm espintcp implementation. The vulnerability occurs in espintcp_sendmsg() when handling blocking callers. The function attempts to flush a pending partial send via espintcp_push_msgs() before constructing a new sk_msg for transmission. If espintcp_push_msgs() returns successfully while the ctx->partial state remains in-flight, the function proceeds to reinitialize emsg->skmsg and reuse ctx->partial, leaving the live transfer orphaned. This state reuse allows a stale offset to persist in the new sk_msg, which can trigger an out-of-bounds read during subsequent send operations in tcp_sendmsg_locked(). The fix ensures that if espintcp_push_msgs() leaves emsg->len populated, the new send is rejected rather than overwriting active partial-send state. Since tcp_sendmsg_locked() already implements appropriate send-buffer wait logic, the patch simply preserves espintcp's single-in-flight transmit invariant.

Business impact

This vulnerability presents a localized but material memory-safety risk to systems running affected Linux kernel versions, particularly those using IPsec over TCP for encrypted tunneling. Exploitation requires local access and the ability to trigger espintcp send operations, but does not require elevated privileges. Successful exploitation could leak sensitive kernel memory to an unprivileged process, potentially revealing cryptographic keys, session tokens, or other confidential data in use by the kernel or other processes. Organizations relying on espintcp for IPsec connectivity should prioritize patching, especially on multi-tenant systems, containerized environments, or systems where unprivileged users have legitimate network access.

Affected systems

This vulnerability affects the Linux kernel across multiple distributions and versions. The espintcp feature is part of the kernel's IPsec (xfrm) subsystem and is available in kernels that have integrated IPsec over TCP support. Users should verify the exact vulnerable versions from their Linux vendor (Red Hat, Ubuntu, Debian, SUSE, etc.) through their respective security advisories. The flaw is present in kernel code paths only when espintcp is in use; systems that do not rely on IPsec over TCP for encryption are not affected by this memory-safety issue even if they run a vulnerable kernel version.

Exploitability

Exploitation requires local system access and the ability to send data over an espintcp socket—typically available to unprivileged users on systems where the feature is enabled. An attacker must trigger the race condition between a blocking send call and an in-flight partial transmission, which can be achieved through normal application behavior or targeted fuzzing of the espintcp code path. The CVSS 3.1 score of 7.8 (HIGH) reflects the local attack vector, low attack complexity, and high potential impact to confidentiality and integrity. Practical exploitation does not require sophisticated techniques; standard socket-based I/O patterns can reliably trigger the flaw. The vulnerability is not currently known to be exploited in active attacks, but the technical barrier to weaponization is low.

Remediation

Apply the Linux kernel security patch that resolves the espintcp partial-send state reuse. Verify the patch details against your Linux vendor's official security advisory. The core fix adds a check in espintcp_sendmsg() to prevent message reconstruction when ctx->partial remains in progress. Coordinate patching with your change-management process, accounting for kernel update downtime and any required system reboots. For systems where immediate patching is not feasible, mitigate by disabling espintcp if it is not in active use, or restrict socket-level access to the feature via user namespaces or capability-based controls if your kernel version supports granular IPsec restrictions.

Patch guidance

Consult your Linux distribution's security advisory for CVE-2026-52935 to obtain the correct patched kernel version for your architecture and release. Major distributions (RHEL, Ubuntu, Debian, SUSE) will provide precompiled kernel packages with this fix. After applying the patch, verify the kernel version post-reboot using `uname -r` and confirm that the espintcp code includes the state-preservation fix. Test IPsec over TCP functionality if it is in production use. For systems running custom or self-compiled kernels, backport the patch from the upstream Linux repository (https://git.kernel.org/) to your in-use kernel version. Document the patch date and version in your change log.

Detection guidance

Monitor kernel logs for signs of memory access violations or NULL pointer dereferences in the xfrm espintcp code path. Use tools like `auditctl` to log socket operations involving IPsec/espintcp if your kernel and audit subsystem support it. During active exploitation, you may observe spurious kernel warnings, page faults, or process crashes in the context of applications using espintcp. Query your kernel build configuration (`grep CONFIG_XFRM_ESPINTCP /boot/config-*`) to confirm espintcp is enabled. Endpoint detection and response (EDR) tools should flag unusual memory access patterns in kernel space triggered from unprivileged user-space processes. If espintcp is not required for your infrastructure, the simplest detection strategy is to verify it is disabled and audit any system claiming to use it.

Why prioritize this

While this vulnerability requires local access and knowledge of espintcp, its memory-safety nature and ability to leak kernel memory elevate it above many local-access vulnerabilities. High-value systems handling encryption, cryptographic material, or multi-tenant workloads should prioritize patching. The CVSS 7.8 score and direct confidentiality impact place it in the HIGH severity tier. Organizations should schedule patching within 2–4 weeks depending on system criticality and operational constraints, but should not defer beyond 6 weeks without documented risk acceptance.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: (1) Local Attack Vector—the attacker must have local system access, limiting the threat population; (2) Low Attack Complexity—no special conditions or timing exploits are required; the race condition triggers under normal blocking I/O; (3) Low Privileges Required—unprivileged users can trigger the flaw; (4) No User Interaction—the attack is fully machine-driven; (5) Unchanged Scope—the impact is confined to the affected local system; (6) High Confidentiality Impact—kernel memory disclosure is possible; (7) High Integrity Impact—the memory-safety bug could allow data corruption; (8) High Availability Impact—kernel panics or process crashes are plausible. The score appropriately captures the severity of a memory-safety vulnerability while acknowledging the local-access requirement.

Frequently asked questions