The Linux kernel bug causes the xfrm ESP input path to decrypt shared packet fragments in place because the SKBFL_SHARED_FRAG flag is not set. When UDP sockets receive ESP‑in‑UDP traffic that is created by splicing non‑private pages with MSG_SPLICE_PAGES, the kernel follows a fast in‑place decryption path that modifies shared memory. This results in corruption of the shared data buffer and the possibility that the encrypted payload becomes visible to processes that share the fragment. The weakness is a CWE‑123 flaw related to incorrect memory handling.

All Linux kernel builds that include the xfrm ESP input routine are affected, regardless of distribution. The issue concerns both IPv4 and IPv6 UDP sockets that use splice operations, and any kernel fork that has not merged the community patch series referenced for versions prior to the commits listed in the advisory remains vulnerable.

The CVSS score of 8.8 and an EPSS score of 26% indicate a relatively high likelihood that the flaw may be exploited in the wild. The vulnerability is not listed in CISA KEV, but it can be exploited by a remote actor who can send crafted ESP‑in‑UDP packets to trigger the vulnerable decryption path. The attacker must be able to target the system's network interface or a service that accepts such traffic. This flaw can lead to inconsistent kernel state, data tampering, or side‑channel leakage; it does not provide immediate remote code execution or privilege escalation as described in the official advisory. The likely attack vector is over the network by a maliciously crafted ESP‑in‑UDP packet sent to the system, based on the note that UDP sockets receive ESP‑in‑UDP traffic constructed via splice operations.