CVE-2024-26953 is a vulnerability in the Linux kernel's networking stack, specifically in the handling of IPsec ESP (Encapsulating Security Payload) packets when combined with GRE (Generic Routing Encapsulation) forwarding that is not offloaded. The flaw arises in the esp_output function when the skb (socket buffer) is reorganized and the pages backing the skb fragments originate from a page_pool allocator. Normally, when skb fragments are released, the pages are returned to the system via put_page. However, if these pages come from a page_pool, calling put_page on them incorrectly causes a leak in the page_pool reference count. This leak accumulates over time and eventually leads to a kernel crash due to a bad page state, as evidenced by the kernel BUG message and page dump in the provided trace. The issue is triggered under configurations with CONFIG_DEBUG_VM enabled and during IPsec + GRE forwarding scenarios that are not offloaded to hardware. The root cause is improper reference counting for page_pool pages during skb fragment release. The proposed fix involves introducing a wrapper function skb_page_unref that correctly handles reference counting for page_pool pages, preventing the leak and subsequent crash. This vulnerability affects Linux kernel versions around the 6.8.0-rc4+ development branch and likely other versions with similar code. No known exploits are reported in the wild yet, but the vulnerability can cause denial of service through kernel crashes in affected systems handling IPsec GRE traffic. The vulnerability does not require user interaction or authentication, as it is triggered by normal packet processing in the kernel networking stack.

For European organizations, this vulnerability poses a risk primarily to systems running Linux kernels with affected versions that handle IPsec ESP traffic encapsulated within GRE tunnels, especially in environments using software-based IPsec + GRE forwarding without hardware offloading. Such configurations are common in enterprise VPN gateways, cloud infrastructure, and network appliances that rely on Linux for secure tunneling and routing. A successful exploitation leads to kernel crashes causing denial of service, potentially disrupting critical network connectivity and secure communications. This can impact availability of VPN services, inter-site connectivity, and cloud workloads relying on these tunnels. Organizations in sectors such as finance, telecommunications, government, and critical infrastructure that depend on secure Linux-based networking could face operational outages and increased incident response costs. Although no direct data confidentiality or integrity compromise is indicated, the denial of service could be leveraged as part of larger attack campaigns to degrade network defenses or cause cascading failures. The lack of known exploits reduces immediate risk, but the vulnerability's presence in widely deployed Linux kernels means that unpatched systems remain vulnerable to accidental or targeted crashes.

1. Immediate application of the official Linux kernel patch that introduces skb_page_unref to correctly handle page_pool page reference counting is the primary mitigation. Organizations should track kernel updates from trusted sources and deploy them promptly. 2. For environments where immediate patching is not feasible, consider disabling or avoiding configurations that combine IPsec ESP with GRE forwarding without hardware offload, if possible, to reduce exposure. 3. Monitor kernel logs for signs of page_pool leaks or kernel BUG messages related to bad page states, which may indicate attempted exploitation or accidental triggering. 4. Employ kernel live patching solutions where available to apply fixes without downtime. 5. Harden network segmentation and limit exposure of vulnerable Linux systems to untrusted networks to reduce risk of triggering the vulnerability remotely. 6. Validate and test VPN and tunneling configurations for stability under load and during IPsec + GRE traffic to detect potential issues early. 7. Maintain robust backup and recovery procedures to minimize impact of potential denial of service incidents caused by kernel crashes.