CVE-2026-52935

A flaw was found in the Linux kernel. The espintcp component, responsible for handling encrypted network traffic, incorrectly reuses a partial data transmission state. This can lead to an out-of-bounds read, which may allow an attacker to access sensitive information or cause other memory corruption issues.

xfrm espintcp can reuse ctx partial while a previous partial send is still in progress. This can attach a stale offset to a new sk_msg and lead to an out of bounds read in the send path. For the CVSS the PR:N is used because a network peer does not need local privileges on the target system, although the target must use ESP in TCP and the attacker must be able to influence a configured transport path. The issue is network reachable in affected IPsec ESP in TCP deployments, but exploitation is high complexity because it depends on an in progress partial send and timing or backpressure conditions. Impact is at least denial of service via kernel crash and may include confidentiality impact if out of bounds data is copied into the transmit path. Integrity impact is not assumed because the patch supports an out of bounds read primitive, not an out of bounds write or arbitrary write primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.