{"id":"CVE-2026-93105","aliases":[],"cve":{"records":[{"id":"CVE-2026-93105","source":"Linux","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-17T16:02:15.085Z","published":"2026-09-17T16:11:16.442Z","modified":"2026-10-30T12:36:00.346Z"}],"publishers":[{"name":"Linux","role":"CNA","organizationId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","modified":"2026-10-30T12:36:00.346Z"}],"references":[{"url":"https://git.kernel.org/stable/c/cb375965800d474c0281a2e92c43c724fce9f463","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/201bdf10ae92e7cbd524adf8c0323e2a963d5fd7","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/3ec55f0c8a6a543cf660584d1346e11f6311ee59","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/1ad6456898f6e6cf58be83bdb607acb1119a9cd1","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/26b6b14c7a0368e317a1e9fb5144ebe6f8d495cf","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/21697720ff43b8dfa25b8e8d9ca7f56f4597fc80","tags":[],"source":"Linux"}],"weaknesses":[],"applicability":[{"source":"Linux","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.11","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.11","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.11","versionEndExcluding":"6.12.114"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.11","versionEndExcluding":"6.18.57"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.11","versionEndExcluding":"7.2.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.11","versionEndExcluding":"7.3"}]}]}]}],"prioritization":[]},"title":"esp: do not unref managed frag pages in esp_ssg_unref()","titleSource":"Linux","descriptionSource":"Linux","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nesp: do not unref managed frag pages in esp_ssg_unref()\n\nesp_ssg_unref() releases the page references held on the source\nscatterlist after the AEAD operation completes.  It calls\nskb_page_unref() on every frag page for an out-of-place transform\n(req->src != req->dst), and in the error path of esp_output_tail()\n(already_unref == true) on the request's own scatterlist.\n\nThis is wrong when the skb carries managed frags\n(SKBFL_MANAGED_FRAG_REFS).  Managed frags are owned by a zerocopy ubuf\nand the skb does not hold a per-frag page reference; io_uring SEND_ZC\nwith a registered buffer attaches the bvec pages this way via\nio_sg_from_iter().  The rest of the stack honours this invariant:\nskb_release_data() skips the per-frag unref when SKBFL_MANAGED_FRAG_REFS\nis set, and skb_zcopy_managed() is the guard used at the other unref\nsites.\n\nesp_ssg_unref() is missing that guard, so for a managed-frag skb it\ndrops a page reference the skb never acquired.  This can underflow the\npage reference count and free a page that is still in use.\n\nGuard the function with skb_zcopy_managed() so both unref paths are\nskipped for managed-frag skbs, matching skb_release_data().","score":7.8,"severity":"high","published":"2026-09-17T16:11:16.442Z","modified":"2026-10-30T12:36:00.346Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"cac2661c53f35cbe651bef9b07026a5a05ab8ce0","status":"affected","lessThan":"cb375965800d474c0281a2e92c43c724fce9f463","versionType":"git"},{"version":"cac2661c53f35cbe651bef9b07026a5a05ab8ce0","status":"affected","lessThan":"201bdf10ae92e7cbd524adf8c0323e2a963d5fd7","versionType":"git"},{"version":"cac2661c53f35cbe651bef9b07026a5a05ab8ce0","status":"affected","lessThan":"3ec55f0c8a6a543cf660584d1346e11f6311ee59","versionType":"git"},{"version":"cac2661c53f35cbe651bef9b07026a5a05ab8ce0","status":"affected","lessThan":"1ad6456898f6e6cf58be83bdb607acb1119a9cd1","versionType":"git"},{"version":"cac2661c53f35cbe651bef9b07026a5a05ab8ce0","status":"affected","lessThan":"26b6b14c7a0368e317a1e9fb5144ebe6f8d495cf","versionType":"git"},{"version":"cac2661c53f35cbe651bef9b07026a5a05ab8ce0","status":"affected","lessThan":"21697720ff43b8dfa25b8e8d9ca7f56f4597fc80","versionType":"git"}],"defaultStatus":"unaffected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-93105"},{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"4.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.11","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.6","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"defaultStatus":"affected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-93105"}],"remediation":[],"references":["https://git.kernel.org/stable/c/cb375965800d474c0281a2e92c43c724fce9f463","https://git.kernel.org/stable/c/201bdf10ae92e7cbd524adf8c0323e2a963d5fd7","https://git.kernel.org/stable/c/3ec55f0c8a6a543cf660584d1346e11f6311ee59","https://git.kernel.org/stable/c/1ad6456898f6e6cf58be83bdb607acb1119a9cd1","https://git.kernel.org/stable/c/26b6b14c7a0368e317a1e9fb5144ebe6f8d495cf","https://git.kernel.org/stable/c/21697720ff43b8dfa25b8e8d9ca7f56f4597fc80"],"sources":[{"name":"CVE","id":"CVE-2026-93105","modified":"2026-10-30T12:36:00.346Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-93105"}],"assessments":[{"source":"Linux","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8}],"sourceAffected":[],"observedAt":"2026-10-30T13:55:01.000Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:25:34.584Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":null}