Answer in brief
CVE-2026-93105 records a High severity (CVSS 7.8) vulnerability in esp: do not unref managed frag pages in esp_ssg_unref(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=cac2661c53f35cbe651bef9b07026a5a05ab8ce0 <26b6b14c7a0368e317a1e9fb5144ebe6f8d495cf || >=cac2661c53f35cbe651bef9b07026a5a05ab8ce0 <21697720ff43b8dfa25b8e8d9ca7f56f4597fc80 | 26b6b14c7a0368e317a1e9fb5144ebe6f8d495cf, 21697720ff43b8dfa25b8e8d9ca7f56f4597fc80 |
| Linux/Linuxgeneric | 4.11 | Not reported |
| Linux/Linuxgeneric | >=cac2661c53f35cbe651bef9b07026a5a05ab8ce0 <1ad6456898f6e6cf58be83bdb607acb1119a9cd1 || >=cac2661c53f35cbe651bef9b07026a5a05ab8ce0 <26b6b14c7a0368e317a1e9fb5144ebe6f8d495cf || >=cac2661c53f35cbe651bef9b07026a5a05ab8ce0 <21697720ff43b8dfa25b8e8d9ca7f56f4597fc80 | 1ad6456898f6e6cf58be83bdb607acb1119a9cd1, 26b6b14c7a0368e317a1e9fb5144ebe6f8d495cf, 21697720ff43b8dfa25b8e8d9ca7f56f4597fc80 |
| Linux/Linuxgeneric | >=cac2661c53f35cbe651bef9b07026a5a05ab8ce0 <201bdf10ae92e7cbd524adf8c0323e2a963d5fd7 || >=cac2661c53f35cbe651bef9b07026a5a05ab8ce0 <3ec55f0c8a6a543cf660584d1346e11f6311ee59 || >=cac2661c53f35cbe651bef9b07026a5a05ab8ce0 <1ad6456898f6e6cf58be83bdb607acb1119a9cd1 || >=cac2661c53f35cbe651bef9b07026a5a05ab8ce0 <26b6b14c7a0368e317a1e9fb5144ebe6f8d495cf || >=cac2661c53f35cbe651bef9b07026a5a05ab8ce0 <21697720ff43b8dfa25b8e8d9ca7f56f4597fc80 | 201bdf10ae92e7cbd524adf8c0323e2a963d5fd7, 3ec55f0c8a6a543cf660584d1346e11f6311ee59, 1ad6456898f6e6cf58be83bdb607acb1119a9cd1, 26b6b14c7a0368e317a1e9fb5144ebe6f8d495cf, 21697720ff43b8dfa25b8e8d9ca7f56f4597fc80 |
| Linux/Linuxgeneric | >=cac2661c53f35cbe651bef9b07026a5a05ab8ce0 <cb375965800d474c0281a2e92c43c724fce9f463 || >=cac2661c53f35cbe651bef9b07026a5a05ab8ce0 <201bdf10ae92e7cbd524adf8c0323e2a963d5fd7 || >=cac2661c53f35cbe651bef9b07026a5a05ab8ce0 <3ec55f0c8a6a543cf660584d1346e11f6311ee59 || >=cac2661c53f35cbe651bef9b07026a5a05ab8ce0 <1ad6456898f6e6cf58be83bdb607acb1119a9cd1 || >=cac2661c53f35cbe651bef9b07026a5a05ab8ce0 <26b6b14c7a0368e317a1e9fb5144ebe6f8d495cf || >=cac2661c53f35cbe651bef9b07026a5a05ab8ce0 <21697720ff43b8dfa25b8e8d9ca7f56f4597fc80 | cb375965800d474c0281a2e92c43c724fce9f463, 201bdf10ae92e7cbd524adf8c0323e2a963d5fd7, 3ec55f0c8a6a543cf660584d1346e11f6311ee59, 1ad6456898f6e6cf58be83bdb607acb1119a9cd1, 26b6b14c7a0368e317a1e9fb5144ebe6f8d495cf, 21697720ff43b8dfa25b8e8d9ca7f56f4597fc80 |
Published upstream
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 17, 2026
In the Linux kernel, the following vulnerability has been resolved: esp: do not unref managed frag pages in esp_ssg_unref() esp_ssg_unref() releases the page references held on the source scatterlist after the AEAD operation completes. It calls skb_page_unref() on every frag page for an out-of-place transform (req->src != req->dst), and in the error path of esp_output_tail() (already_unref == true) on the request's own scatterlist. This is wrong when the skb carries managed frags (SKBFL_MANAGED_FRAG_REFS). Managed frags are owned by a zerocopy ubuf and the skb does not hold a per-frag page reference; io_uring SEND_ZC with a registered buffer attaches the bvec pages this way via io_sg_from_iter(). The rest of the stack honours this invariant: skb_release_data() skips the per-frag unref when SKBFL_MANAGED_FRAG_REFS is set, and skb_zcopy_managed() is the guard used at the other unref sites. esp_ssg_unref() is missing that guard, so for a managed-frag skb it drops a page reference the skb never acquired. This can underflow the page reference count and free a page that is still in use. Guard the function with skb_zcopy_managed() so both unref paths are skipped for managed-frag skbs, matching skb_release_data().
Quoted source text, attributed separately from HOL analysis.