CVE-2024-26953

CVE-2024-26953 describes a page_pool leak vulnerability in the Linux kernel's ESP (Encapsulating Security Payload) protocol implementation. Specifically, when an skb (socket buffer) is reorganized during esp_output and its fragment pages originate from a page_pool, calling put_page on them incorrectly leads to a memory leak, eventually causing a system crash. This issue impacts Linux kernel versions and can be observed with IPsec and GRE forwarding. The vulnerability is rated Medium severity (CVSS 5.5) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. This indicates that a local attacker with low privileges can exploit this flaw with low attack complexity, resulting in high availability impact (system crash) but no confidentiality or integrity impact. There is currently no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness or attention at this time.