The Linux kernel’s IPTFS payload handling contains missing validation of inner IPv4 packet fields parsed from decrypted ESP payloads. An attacker can craft an ESP packet that contains an inner IPv4 header with a total length of zero or a malformed header length. This causes the inner packet processor to enter an infinite loop in softirq context because the length checks allow the offset to remain zero and the loop never terminates, consuming CPU and disabling packet processing.

All Linux kernels that include the IPTFS implementation prior to the commit adding tot_len and ihl validation are affected. This includes every release from the upstream Linux branch until the patch is applied; the CPE list covers kernels 6.14 and all 7.0 release candidates.

The likely attack vector is inferred from the description: a remote adversary can trigger the denial of service by sending the crafted packet over any interface that processes IPsec traffic. The vulnerability does not require elevated privileges and can be exploited from any network location that can reach the host. The EPSS score is below 1% and the CVE is not in the CISA KEV catalog, but the medium CVSS score of 5.5, combined with the ease of remote trigger, still represents a notable risk to availability.