{
  "cveId": "CVE-2026-64566",
  "url": "https://patchblox.com/security/cve/CVE-2026-64566",
  "summary": "CVE-2026-64566 is fixed in linux on 1 platform by DEBIAN-CVE-2026-64566 (version 7.1.6-1), released August 7, 2026. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptf...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()  When iptfs_skb_add_frags() copies frag references from the source frag walk into a new SKB, it increments the page reference count via __skb_frag_ref() but does not propagate SKBFL_SHARED_FRAG to the destination SKB\u0027s skb_shinfo-\u003Eflags.  If the source SKB carries shared frags (e.g. from a page-pool backed receive path), the new inner SKB will appear to ESP as having privately owned frags.  A subsequent esp_input() call for a nested transport-mode SA then takes the no-COW fast path and decrypts in place, writing over pages that are still referenced by the outer IPTFS SKB.  This causes kernel-visible memory corruption and can trigger a panic.  All other frag-transfer helpers in the kernel (skb_try_coalesce, skb_gro_receive, __pskb_copy_fclone, skb_shift, skb_segment) correctly propagate SKBFL_SHARED_FRAG; align iptfs_skb_add_frags() with this convention by setting the flag inside the loop immediately after __skb_frag_ref() and nr_frags\u002B\u002B, so every exit path that attaches a frag unconditionally propagates SKBFL_SHARED_FRAG.",
  "published": "2026-08-05T08:16:36Z",
  "severity": "critical",
  "cvss": 9.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00352,
  "epssPercentile": 0.29034,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.6-1",
      "fix": "DEBIAN-CVE-2026-64566",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64566",
      "released": "2026-08-07T15:22:10Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}