This bug involves the Linux kernel's ESP over TCP (espintcp) module. When the transmit queue reaches capacity, esp_output_tail_tcp returns an error but fails to free the associated socket buffer (skb). With synchronous crypto, a subsequent common xfrm output drop handles the cleanup, but with asynchronous crypto (esp_output_done) the skb is never freed. The resulting leak accumulates unreferenced skbs in memory. Over time, unbounded accumulation can exhaust kernel memory, destabilizing the system or allowing an attacker to trigger a denial‑of‑service by exhausting resources. The weakness maps to CWE‑459: Resource Leak.

The flaw exists in the Linux kernel code that implements ESP over TCP. All distributions packaging unpatched Linux kernels are potentially affected; the precise version range is not specified in the advisory. Any system running the old kernel build that handles IPsec over TCP and uses asynchronous crypto code is susceptible. The vulnerability affects the kernel itself rather than user space applications.

Because EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, the attack surface is not known to be actively exploited. However, the bug can be triggered by sending a high volume of ESP‑encrypted TCP packets that fill the transmit queue. Thus remote attackers who can inject such traffic could drain memory resources over time. While no public exploit is demonstrated, the combination of a resource leak and potential for sustained traffic makes it a medium‑to‑high risk for vulnerable hosts. Administrators should treat this as a potential denial‑of‑service scenario until a patch is applied.