CVE-2026-63912

A flaw was found in the Linux kernel's Encapsulating Security Payload (ESP) component. This vulnerability occurs in the ESP out-of-place fast path when handling combined single-fragment lengths. An attacker could potentially trigger a scenario where the system rejects the page-fragment fast path, leading to a denial of service (DoS) condition. This issue affects both IPv4 and IPv6.

Red Hat has rated this vulnerability as Moderate severity because triggering the condition requires an active IPsec configuration using Encapsulating Security Payload (ESP) under specific packet fragmentation criteria, limiting the primary impact to a denial of service rather than arbitrary privilege escalation or unauthorized data access. Default installations of Red Hat Enterprise Linux do not establish IPsec security associations or transform outbound ESP traffic automatically, substantially narrowing the attack surface to specialized networking environments. Even when IPsec is utilized, successful exploitation demands non-standard frame lengths and transmission timing, which further reduces exploitability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.