Linux Kernel ESP-in-UDP Shared Fragment In-Place Decrypt Flaw

CVE-2026-43284 is a high-severity vulnerability in the Linux kernel's xfrm (IPsec transform) subsystem affecting ESP (Encapsulating Security Payload) over UDP implementations. The vulnerability stems from the kernel's failure to properly mark shared socket buffer fragments as protected when data is spliced directly from pipes into UDP skbs. When MSG_SPLICE_PAGES attaches pipe pages to network packets, the kernel should flag these as SKBFL_SHARED_FRAG to prevent in-place modification. Because the IPv4/IPv6 datagram append paths omit this critical flag, ESP decryption operations can corrupt shared memory pages—potentially affecting any system handling ESP-in-UDP traffic, particularly VPN implementations, containerized environments, and network appliances relying on kernel-space encryption.

While CVE-2026-43284 lacks mapped MITRE ATT&CK techniques and currently shows no Casky skill matches, the vulnerability's detection would benefit from extended reasoning across kernel memory safety patterns and IPsec protocol anomalies. Practitioners using Casky would observe findings centered on CWE-123 (Write-What-Where condition) manifestations: unexpected memory corruption in packet processing paths, data integrity failures in encrypted UDP streams, and race conditions between packet splicing and cryptographic operations. Security teams should monitor for kernel crash dumps showing xfrm/ESP stack traces, packet processing anomalies in VPN/IPsec contexts, and potential denial-of-service indicators when shared buffer fragments are inadvertently modified during decryption operations.