The Linux kernel contains a flaw in the xfrm ESP input path: when a packet is constructed from shared pipe pages with MSG_SPLICE_PAGES, the kernel fails to mark the shared fragments with SKBFL_SHARED_FRAG. Consequently, the fast decryption path decrypts the packet data in place even though the memory is shared. This corrupts or unintentionally exposes data that may be referenced by other sockets, leading to integrity violations and potential leakage of sensitive information. No elevation of privilege or remote execution is provided by the flaw, but the kernel’s state can be compromised during normal packet processing.

All Linux kernel builds that employ the xfrm ESP input routine, regardless of distribution, are affected when UDP sockets receive ESP‑in‑UDP traffic constructed via splice operations. The flaw applies to both IPv4 and IPv6 variants, as the code paths do not differentiate between them when setting the shared fragment flag. The vulnerability exists in the current mainline kernel and any derivative that has not yet incorporated the patch series that adds the flag and forces a copy‑on‑write before decryption.

The CVSS base score is 7.8, and EPSS data is unavailable, but the kernel nature of the flaw suggests a high severity rating. The vulnerability is not listed in CISA’s KEV, indicating no active exploitation has been observed yet. Exploitation would require an attacker capable of crafting and sending malicious ESP‑in‑UDP packets that trigger the splice path, a scenario more likely in an environment where the kernel receives untrusted network traffic. Because the issue only corrupts shared memory, it can be used to tamper with traffic flows or facilitate side‑channel leakage rather than granting arbitrary code execution.