# CVE-2026-93105: esp: do not unref managed frag pages in esp_ssg_unref()

CVE-2026-93105 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-93105, released September 23, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-93105
- Priority: High
- CVSS: 7.8 (Moderate)
- EPSS: 0.0018
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 17, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-93105

## Description

In the Linux kernel, the following vulnerability has been resolved:  esp: do not unref managed frag pages in esp_ssg_unref()  esp_ssg_unref() releases the page references held on the source scatterlist after the AEAD operation completes.  It calls skb_page_unref() on every frag page for an out-of-place transform (req->src != req->dst), and in the error path of esp_output_tail() (already_unref == true) on the request's own scatterlist.  This is wrong when the skb carries managed frags (SKBFL_MANAGED_FRAG_REFS).  Managed frags are owned by a zerocopy ubuf and the skb does not hold a per-frag page reference; io_uring SEND_ZC with a registered buffer attaches the bvec pages this way via io_sg_from_iter().  The rest of the stack honours this invariant: skb_release_data() skips the per-frag unref when SKBFL_MANAGED_FRAG_REFS is set, and skb_zcopy_managed() is the guard used at the other unref sites.  esp_ssg_unref() is missing that guard, so for a managed-frag skb it drops a page reference the skb never acquired.  This can underflow the page reference count and free a page that is still in use.  Guard the function with skb_zcopy_managed() so both unref paths are skipped for managed-frag skbs, matching skb_release_data().

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.115-2 | [DEBIAN-CVE-2026-93105](https://patchblox.com/security/data/fix/linux/debian-cve-2026-93105.md) | Sep 23, 2026 |
| Linux | linux Debian 14 | 7.2.6-1 | [DEBIAN-CVE-2026-93105](https://patchblox.com/security/data/fix/linux/debian-cve-2026-93105.md) | Sep 23, 2026 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.