CVE-2026-64566

A MODERATE severity flaw in the Linux kernel's iptfs (IP Traffic Flow Security) packet processing can cause kernel memory corruption and a system crash, resulting in a denial of service. When iptfs_skb_add_frags() copies fragment references from a source SKB that carries shared fragments (for example, from a page-pool backed receive path) into a new SKB, it increments the page reference count but does not propagate the SKBFL_SHARED_FRAG flag to the destination SKB. The new inner SKB therefore appears to ESP as having privately owned fragments, so a subsequent esp_input() call for a nested transport-mode SA takes the no-copy-on-write fast path and decrypts in place, overwriting pages that are still referenced by the outer IPTFS SKB. Exploitation requires a specific configuration using IP-TFS with a nested transport-mode SA and a receive path that supplies shared fragments; triggering the flaw causes kernel-visible memory corruption that can result in a kernel panic and loss of system availability. Red Hat Enterprise Linux and Red Hat In-Vehicle OS are not affected by this flaw because the vulnerable code is not present in the shipped kernel packages. The Red Hat severity (MODERATE, CVSS 5.5) differs from the upstream CVE.org CRITICAL rating (9.8) because exploitation depends on an uncommon IP-TFS configuration with a nested transport-mode SA, the primary impact is availability, and no compromise of confidentiality or integrity has been demonstrated.