The vulnerability resides in the Linux kernel’s IPTFS payload handling. A crafted ESP packet carrying an inner IPv4 header with a total length of zero or malformed header length bypasses validation, causing an infinite loop in softirq context. This loop prevents the data offset from advancing, resulting in a never‑terminating while loop that consumes CPU time and stalls packet processing, effectively crashing or disabling the kernel’s networking stack. The weakness is a missing input validation that leads to uncontrolled resource consumption.

Both Linux kernel distributions are affected, including all versions shipped by Linux:Linux until the patch that adds inner packet length validation is applied. No specific version list is supplied, so all kernels prior to the commit that introduced the validation of tot_len and ihl fields are vulnerable.

The attack vector is network‑based; an adversary can send crafted ESP packets from outside or inside the network to trigger the infinite loop. EPSS data are not available, and the vulnerability is not listed in CISA’s KEV catalog, but the denial of service impact combined with the ability to trigger it remotely indicates a high risk. The lack of hardening in the kernel’s packet processing path means the exploit requires no special privileges and can be executed from any source that can reach the vulnerable host.