Linux Kernel ESP Page Fragment Reference Leak Vulnerability

A vulnerability exists in the Linux kernel's ESP (Encapsulating Security Payload) handling for both IPv4 and IPv6. When the 'inplace' flag is false, the old page fragments are replaced with new ones from the xfrm page fragment cache. The source scatterlist is created from the old fragments before the replacement, and a function is supposed to release the old page references after the cryptographic operation. However, if the process of building the destination scatterlist from the new page fails, the old page references in the source scatterlist are not released, leading to a memory leak. This issue arises because the error handling only frees the memory for the new page, leaving the old ones unreferenced.

Impact

Failing to properly release the old page fragment references can lead to a memory leak, where allocated memory is not returned to the system, potentially causing exhaustion of available memory resources over time.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the Linux Kernel Archives.