What is the CVSS score of CVE-2026-63912?

CVE-2026-63912 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-63912?

CVE-2026-63912 is a critical memory corruption vulnerability in Linux kernel IPsec ESP transforms that affects systems using IPsec for VPN or encrypted network communications.. A patch is available.

How to fix or mitigate CVE-2026-63912?

Within 24 hours, identify all Linux systems running IPsec ESP transforms by auditing VPN appliances, edge gateways, and tunnel configurations for active esp policies or xfrm rules. Within 7 days, apply the available vendor patch to the Linux kernel on affected systems and coordinate reboots during maintenance windows to activate the updated kernel. Within 30 days, perform automated verification that all affected systems are running the patched kernel version and conduct post-patch regression testing on IPsec tunnel functionality.

Linux Kernel CVE-2026-63912

EUVD-2026-45685 CRITICAL

2026-07-19 Linux

GHSA-6c6h-95cx-j99f

Information Disclosure Linux

Critical

Disputed · 9.8 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.7 HIGH

Reachable over the network but only when IPsec ESP is configured and a specific combined-length/fragmentation condition is met (AC:H); no auth at app layer (PR:N); impact is primarily kernel memory disclosure and crash (C:H/A:H, I:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:15 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

9.8 (CRITICAL)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:55 cve.org

CRITICAL 9.8

CVE Published

Jul 19, 2026 - 14:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xfrm: esp: restore combined single-frag length gate

The ESP out-of-place fast path appends the trailer in esp_output_head() before esp_output_tail() allocates the destination page frag. The head-side gate currently checks skb->data_len and tailen separately, but the tail code allocates a single destination frag from the combined post-trailer skb->data_len.

Reject the page-frag fast path when the combined aligned length exceeds a page. Otherwise skb_page_frag_refill() may fall back to a single page while the destination sg still spans the combined skb->data_len.

Restore this combined-length page gate for both IPv4 and IPv6.

AnalysisAI

Out-of-bounds memory access in the Linux kernel IPsec ESP output path (xfrm/esp) occurs when the out-of-place fast path appends the ESP trailer in esp_output_head() but the head-side length gate checks skb->data_len and tailen separately, while esp_output_tail() later allocates a single destination page fragment from the combined post-trailer skb->data_len. When the combined aligned length exceeds one page, skb_page_frag_refill() may return a single page while the destination scatterlist still spans the larger combined length, producing a scatter-gather over-read/over-write. Affected are kernels using ESP transforms for both IPv4 and IPv6; the fix restores the combined-length page gate. No public exploit is identified at time of analysis and EPSS risk is low (0.21%, 11th percentile).

Technical ContextAI

The vulnerability lives in the kernel's XFRM/IPsec ESP encapsulation code (net/ipv4/esp4.c and net/ipv6/esp6.c). ESP (Encapsulating Security Payload, RFC 4303) encrypts and authenticates tunnel/transport traffic; on the transmit path the kernel builds a scatter-gather (sg) list over the socket buffer (skb) and appends an ESP trailer (padding, pad length, next header) plus ICV. In the 'out-of-place' fast path the trailer is added in esp_output_head() while the destination page fragment is not allocated until esp_output_tail(), which requests a single frag sized from the combined post-trailer skb->data_len. Because the earlier gate validated skb->data_len and the trailer length (tailen) independently rather than as a combined aligned total, a skb_page_frag_refill() single-page fallback can under-size the destination while the sg list still describes the full combined length. The root cause is an inconsistent/insufficient length bound check between the two stages (a length-validation / out-of-bounds class defect; the input lists CWE as N/A, but this maps to CWE-125/CWE-787-style out-of-bounds access). CPE data identifies the affected component only generically as cpe:2.3:a:linux:linux, i.e., the mainline Linux kernel across many stable branches.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 7.0.12, or mainline 7.1 (choose the fix matching your branch), then reboot to load the patched kernel or apply the corresponding livepatch if your distribution provides one. The fix restores the combined-length page gate that rejects the page-frag fast path when the combined aligned length exceeds a page. Apply the exact stable commits referenced at git.kernel.org (e.g., 566295735530…, dfa0d7b0ff1e…, and the matching backport for your series) via your distribution's kernel update channel. If immediate patching is not possible, the practical compensating control is to reduce or avoid the vulnerable path: restrict or disable IPsec ESP offload/transforms on affected hosts where feasible, and limit which peers can establish ESP SAs to trusted, authenticated endpoints (IPsec already authenticates SAs, so tightening SA policy and lowering path MTU to keep frames under the page threshold reduces exposure) - with the trade-off that constraining MTU or disabling ESP degrades or breaks IPsec connectivity for legitimate tunnels. Because this is a data-path kernel bug, there is no clean per-endpoint firewall block; prioritize the kernel upgrade.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-63912 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63912

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code