CVE-2026-63872

In the Linux kernel, the following vulnerability has been resolved:

esp: fix page frag reference leak on skbtosgvec failure

In espoutputtail(), when esp->inplace is false, the old skb page frags are replaced with a new page from the xfrm pagefrag cache. The source scatterlist (sg) is built from the old frags before the replacement, and espssg_unref() is responsible for releasing the old page references after the crypto operation completes.

However, if the second skbtosgvec() call (which builds the destination scatterlist from the new page) fails, the code jumps to error_free which only calls kfree(tmp). The old page frag references captured in the source scatterlist are never released:

1. sg[] is built from old frags via skbtosgvec() (no extra get_page)
2. nr_frags is set to 1 and frag[0] is replaced with the new page
3. Second skbtosgvec() fails -> goto error_free
4. kfree(tmp) frees the sg[] memory but old frags are not unref'd
5. kfree_skb() only releases frag[0] (the new page), not the old ones

Fix this by adding a bool parameter to espssgunref() that, when true, unconditionally unrefs the source scatterlist frags without checking req->src and req->dst, since those fields are not yet initialized by aeadrequestset_crypt() at the point of the error. Existing callers pass false to preserve the original behavior.

The same issue exists in both esp4 and esp6 as the code is identical.