Re: CVE-2026-43284: xfrm: esp: avoid in-place decrypt on shared skb frags

[Greg Kroah-Hartman]

On Fri, May 08, 2026 at 10:57:05AM +0200, Massimiliano Pellizzer wrote:
> On Fri, May 8, 2026 at 9:24 AM Greg Kroah-Hartman
> I tested the publicly available exploit against the stable kernel 5.15.204.
> That stable branch is affected too.
> 
> ```
> $ ./run.sh
> === Stage 1 — overwrite 'systemd-timesync' line (89 bytes) with
> 'sick::0:0:<pad>:/:/bin/bash'
> === Stage 2 — verify
> sick::0:0:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:/:/bin/bash
> === Stage 3 — su - sick (empty password via PAM nullok)
> [i] state saved to /var/tmp/.cf2.state — run './run.sh --clean' to revert
> # whoami
> root
> # uname -r
> 5.15.204
> ```
> 

Yes, patches for that are being worked on right now, give me a chance to
get some lunch :)

thanks,

greg k-h