In the Linux kernel, the following vulnerability has been resolved:

xfrm: esp: restore combined single-frag length gate

The ESP out-of-place fast path appends the trailer in esp_output_head()
before esp_output_tail() allocates the destination page frag. The
head-side gate currently checks skb->data_len and tailen separately, but
the tail code allocates a single destination frag from the combined
post-trailer skb->data_len.

Reject the page-frag fast path when the combined aligned length exceeds a
page. Otherwise skb_page_frag_refill() may fall back to a single page while
the destination sg still spans the combined skb->data_len.

Restore this combined-length page gate for both IPv4 and IPv6.

https://git.kernel.org/stable/c/322e48187e0245ab2fff6fec2220b0cae677dbec

https://git.kernel.org/stable/c/36519e3d941fc99d3b52c134dbaf311f987a4708

https://git.kernel.org/stable/c/566295735530ee513326049b0540f32ec050bf2e

https://git.kernel.org/stable/c/5d7ab86e2b6bc23054616bf6ac562013bf60af8c

https://git.kernel.org/stable/c/65f3b3fc2347b89fe21db1e92c7681368415f095

https://git.kernel.org/stable/c/b84091ceddc9f133229dceab3ccc930bf27f9cba

https://git.kernel.org/stable/c/c093468aea8277f77272a4f199b2e15e19cabb59

https://git.kernel.org/stable/c/dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv4/esp4.c","net/ipv6/esp6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c075c3ea031757f8ea2d34567565b61a868c08d5","lessThan":"566295735530ee513326049b0540f32ec050bf2e","versionType":"git","status":"affected"},{"version":"a583f2f3c8788bffd7fd7baeb76bd6d80543d7ea","lessThan":"5d7ab86e2b6bc23054616bf6ac562013bf60af8c","versionType":"git","status":"affected"},{"version":"5bd8baab087dff657e05387aee802e70304cc813","lessThan":"36519e3d941fc99d3b52c134dbaf311f987a4708","versionType":"git","status":"affected"},{"version":"5bd8baab087dff657e05387aee802e70304cc813","lessThan":"322e48187e0245ab2fff6fec2220b0cae677dbec","versionType":"git","status":"affected"},{"version":"5bd8baab087dff657e05387aee802e70304cc813","lessThan":"b84091ceddc9f133229dceab3ccc930bf27f9cba","versionType":"git","status":"affected"},{"version":"5bd8baab087dff657e05387aee802e70304cc813","lessThan":"c093468aea8277f77272a4f199b2e15e19cabb59","versionType":"git","status":"affected"},{"version":"5bd8baab087dff657e05387aee802e70304cc813","lessThan":"65f3b3fc2347b89fe21db1e92c7681368415f095","versionType":"git","status":"affected"},{"version":"5bd8baab087dff657e05387aee802e70304cc813","lessThan":"dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40","versionType":"git","status":"affected"},{"version":"2c66b0c95bb0aa7652ba1eba293d0d5993b35a38","versionType":"git","status":"affected"},{"version":"ef6f83df1209a7d9bd1c605a62457d4c00f9179e","versionType":"git","status":"affected"},{"version":"3defefd22ad5fbbe639b6157fb7e6311b2bf333d","versionType":"git","status":"affected"},{"version":"b657030870bb5351c5b1e84d4e9f186da6ca0496","versionType":"git","status":"affected"},{"version":"5.10.113","lessThan":"5.10.259","versionType":"semver","status":"affected"},{"version":"5.15.36","lessThan":"5.15.210","versionType":"semver","status":"affected"},{"version":"4.14.288","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.19.252","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.4.205","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"5.17.5","lessThan":"5.18","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv4/esp4.c","net/ipv6/esp6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"5.10.259","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.210","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.35","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.12","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]