Linux Kernel CVE-2026-93105

Requires local code execution on a kernel where IPsec ESP output is configured for traffic, AND the sending process uses io_uring SEND_ZC with a registered/managed-frag (SKBFL_MANAGED_FRAG_REFS) buffer whose pages traverse the ESP transform. Triggered specifically in the out-of-place transform case (req->src != req->dst) or the esp_output_tail error path (already_unref). Limiting factors: not reachable against default hosts without IPsec ESP in use; requires the io_uring zerocopy send path rather than ordinary sockets; no remote or unauthenticated vector; impact is kernel memory corruption/crash rather than data theft.

The vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates real-world risk. The vector's local, low-complexity, low-privilege framing is defensible for the access requirement, but AC:L understates the preconditions: the flaw only triggers when the host is configured for IPsec ESP output AND the transmitting local process uses io_uring SEND_ZC with a registered (managed-frag) buffer that routes through the ESP transform - a specific software path, not a default one. The C:H/I:H triad is misleading: this is a page reference-count underflow that frees a page still in use (a use-after-free / memory-corruption primitive), which is overwhelmingly a crash/DoS and potential corruption issue, not an information-disclosure or integrity-of-data flaw. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so there is no signal of active or automated exploitation. SSVC-style read: exploitation=none observed, automatable=no (requires a crafted local zerocopy send over an IPsec-configured path), technical impact=partial-to-total (kernel memory corruption). Net: a legitimate kernel memory-safety bug worth patching on IPsec+io_uring hosts, but a moderate priority rather than the high-7.8 the vendor score implies. Note the conflict to verify: the 'Information Disclosure' tag contradicts the actual UAF/DoS impact, and CWE is listed as N/A despite a clear CWE-416/415-class defect.

A local user on a host configured for IPsec ESP output sends data through an io_uring SEND_ZC operation backed by a registered (bvec/managed-frag) buffer. After the AEAD transform completes, esp_ssg_unref() drops a page reference the skb never acquired, underflowing the page refcount and freeing a page still in active use, corrupting kernel memory and typically crashing the system. No public exploit code is identified at time of analysis; the path requires both IPsec configuration and the io_uring zerocopy send code path.