Based on the description, this bug involves the Linux kernel's ESP over TCP (espintcp) module. When the transmit queue reaches capacity, esp_output_tail_tcp returns an error but fails to free the associated socket buffer (skb). With synchronous crypto, the subsequent common xfrm output drop handles the cleanup, but with asynchronous crypto (esp_output_done) the skb is never freed. The resulting leak accumulates unreferenced skbs in memory. Over time, unbounded accumulation can exhaust kernel memory, destabilizing the system. The weakness maps to CWE-401 (Memory Leak) and CWE-772. A remote attacker could trigger a denial‑of‑service by repeatedly sending ESP‑over‑TCP packets to fill the queue, causing the skb leak to accumulate and eventually exhaust kernel memory.

Based on the description, the flaw exists in Linux kernel code that implements ESP over TCP. All Linux distributions packaging unpatched kernels are potentially affected; the advisory does not specify a precise kernel version range. Any system running the unpatched kernel build that handles IPsec over TCP and uses asynchronous crypto code is susceptible. The vulnerability affects the kernel itself rather than user‑space applications.

Because the EPSS score is < 1% and the CVE is not listed in the CISA KEV catalog, no large‑scale exploitation has been observed yet. The CVSS score of 5.5 indicates a medium severity. Based on the description, the attack vector is likely remote traffic targeting the ESP‑over‑TCP path, which can trigger the skb leak.