CVSS 7.8 (HIGH) · Actively exploited (listed in CISA KEV) · Affects: Linux kernel
A vulnerability in the Linux kernel allows the shared-frag marker to be lost during skb coalescing. This breaks invariants relied upon by ESP input checks, potentially allowing in-place decryption over page-cache-backed fragments.
Attackers with local privileges can exploit this to achieve high confidentiality, integrity, and availability impacts. The issue is actively exploited and poses a severe risk to system security.
Apply the latest kernel patches immediately to resolve the shared-frag marker propagation issue. Ensure compliance with CISA BOD 26-04 guidance for prioritizing security updates.
Linux 核心中存在漏洞，導致 skb 合併期間共享片段標記丟失。這破壞了 ESP 輸入檢查所依賴的不變量，可能允許在頁面緩存支持的片段上進行就地解密。
立即應用最新的內核補丁以解決共享片段標記傳播問題。確保遵守 CISA BOD 26-04 關於優先處理安全更新的指導方針。