Withdrawn: this CVE is not a vulnerability
The assigning CNA withdrew CVE-2026-63872 on 11 August 2026, and it carries the Rejected state at CVE.org and NVD. It must not be treated as a live finding. Its pre-withdrawal severity, score and exploitability are withheld below; the record itself is kept because withdrawals are reversible and because the reject reason is the correction worth publishing.
WITHDRAWN
CVE-2026-63872
esp: fix page frag reference leak on skb_to_sgvec failure
Overview
Description
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Details
INFO
Published Date :
July 19, 2026, 3:16 p.m.
Last Modified :
Aug. 11, 2026, 3:18 a.m.
Remotely Exploit :
—
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-63872 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-63872 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Rejected by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 11, 2026
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 11, 2026
Action Type Old Value New Value Changed Description In the Linux kernel, the following vulnerability has been resolved: esp: fix page frag reference leak on skb_to_sgvec failure In esp_output_tail(), when esp->inplace is false, the old skb page frags are replaced with a new page from the xfrm page_frag cache. The source scatterlist (sg) is built from the old frags before the replacement, and esp_ssg_unref() is responsible for releasing the old page references after the crypto operation completes. However, if the second skb_to_sgvec() call (which builds the destination scatterlist from the new page) fails, the code jumps to error_free which only calls kfree(tmp). The old page frag references captured in the source scatterlist are never released: 1. sg[] is built from old frags via skb_to_sgvec() (no extra get_page) 2. nr_frags is set to 1 and frag[0] is replaced with the new page 3. Second skb_to_sgvec() fails -> goto error_free 4. kfree(tmp) frees the sg[] memory but old frags are not unref'd 5. kfree_skb() only releases frag[0] (the new page), not the old ones Fix this by adding a bool parameter to esp_ssg_unref() that, when true, unconditionally unrefs the source scatterlist frags without checking req->src and req->dst, since those fields are not yet initialized by aead_request_set_crypt() at the point of the error. Existing callers pass false to preserve the original behavior. The same issue exists in both esp4 and esp6 as the code is identical. Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Removed CVSS V3.1 kernel.org: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Removed Reference kernel.org: https://git.kernel.org/stable/c/2982e599fff6faa21c8df147d96fc7af6c1a2f24 Removed Reference kernel.org: https://git.kernel.org/stable/c/e705b8ff4dd38fb8fe4e6fdc5378a86acea4feb5 Removed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'cac2661c53f35cbe651bef9b07026a5a05ab8ce0', 'lessThan': 'e705b8ff4dd38fb8fe4e6fdc5378a86acea4feb5', 'versionType': 'git'}, {'status': 'affected', 'version': 'cac2661c53f35cbe651bef9b07026a5a05ab8ce0', 'lessThan': '2982e599fff6faa21c8df147d96fc7af6c1a2f24', 'versionType': 'git'}], 'programFiles': ['net/ipv4/esp4.c', 'net/ipv6/esp6.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.11'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.11', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ipv4/esp4.c', 'net/ipv6/esp6.c'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 20, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'cac2661c53f35cbe651bef9b07026a5a05ab8ce0', 'lessThan': 'e705b8ff4dd38fb8fe4e6fdc5378a86acea4feb5', 'versionType': 'git'}, {'status': 'affected', 'version': 'cac2661c53f35cbe651bef9b07026a5a05ab8ce0', 'lessThan': '2982e599fff6faa21c8df147d96fc7af6c1a2f24', 'versionType': 'git'}], 'programFiles': ['net/ipv4/esp4.c', 'net/ipv6/esp6.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.11'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.11', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ipv4/esp4.c', 'net/ipv6/esp6.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: esp: fix page frag reference leak on skb_to_sgvec failure In esp_output_tail(), when esp->inplace is false, the old skb page frags are replaced with a new page from the xfrm page_frag cache. The source scatterlist (sg) is built from the old frags before the replacement, and esp_ssg_unref() is responsible for releasing the old page references after the crypto operation completes. However, if the second skb_to_sgvec() call (which builds the destination scatterlist from the new page) fails, the code jumps to error_free which only calls kfree(tmp). The old page frag references captured in the source scatterlist are never released: 1. sg[] is built from old frags via skb_to_sgvec() (no extra get_page) 2. nr_frags is set to 1 and frag[0] is replaced with the new page 3. Second skb_to_sgvec() fails -> goto error_free 4. kfree(tmp) frees the sg[] memory but old frags are not unref'd 5. kfree_skb() only releases frag[0] (the new page), not the old ones Fix this by adding a bool parameter to esp_ssg_unref() that, when true, unconditionally unrefs the source scatterlist frags without checking req->src and req->dst, since those fields are not yet initialized by aead_request_set_crypt() at the point of the error. Existing callers pass false to preserve the original behavior. The same issue exists in both esp4 and esp6 as the code is identical. Added Reference https://git.kernel.org/stable/c/2982e599fff6faa21c8df147d96fc7af6c1a2f24 Added Reference https://git.kernel.org/stable/c/e705b8ff4dd38fb8fe4e6fdc5378a86acea4feb5
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.