CVE-2026-43284: Unsafe ESP decryption on shared fragments

CVE-2026-43284 is a vulnerability in the Linux kernel affecting the ESP (Encapsulating Security Payload) decryption path. The flaw allows in-place decryption of data on socket buffer fragments not privately owned by the skb but shared from a UDP pipe via MSG_SPLICE_PAGES. This impacts systems using IPsec with UDP, where pipe pages are attached directly to the network buffer.

The vulnerability scores CVSS 8.8 (high) and was officially published on 2026-05-08. By November 2026, concrete public signals emerged: GitHub repositories reported mitigation modules specific to Android Galaxy S25 devices that privatize ESP receive buffers. These signals indicate the flaw is known and potentially exploited in real-world environments.

Linux system administrators using IPsec with ESP must verify kernel patches are applied. The fix requires marking shared fragments with the SKBFL_SHARED_FRAG flag and falling back to skb_cow_data() when the flag is present, preventing ESP from decrypting in-place on shared buffers. Check vendor updates through official channels and, if IPsec is not required in production, disable it until patches are applied and verified.