CVE-2024-26953: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26953 affects the Linux kernel's ESP (Encapsulating Security Payload) implementation. The vulnerability was discovered when the skb (socket buffer) is reorganized during esp_output (!esp->inline), where pages from the original skb fragments are supposed to be released back to the system through put_page. However, if the skb fragment pages originate from a page_pool, calling put_page triggers a page_pool leak that eventually results in a crash (Kernel Git).

The vulnerability stems from improper handling of pages from page_pool in the Linux kernel's ESP implementation. The issue occurs specifically during the ESP output processing when the socket buffer is reorganized. The bug manifests when using CONFIG_DEBUG_VM and performing IPsec + GRE (non-offloaded) forwarding, resulting in a page_pool leak. The technical fix involves introducing a new wrapper (skb_page_unref) that properly handles page refcounting for page_pool pages (Kernel Git).

When exploited, this vulnerability causes a page_pool leak which eventually leads to a system crash. This primarily affects systems using IPsec with GRE tunneling in non-offloaded configurations (Kernel Git).

The vulnerability can be triggered during normal operation when using IPsec with GRE tunneling in non-offloaded configurations. It requires no special privileges beyond the ability to use these networking features (Kernel Git).

The fix has been implemented by introducing a new wrapper function (skb_page_unref) that properly handles page refcounting for page_pool pages. This patch has been merged into the Linux kernel and is being backported to stable kernel versions. Users should update to patched kernel versions when available (Kernel Git).