In the Linux kernel, the Authentication Header (AH) implementation incorrectly handled the Extended Sequence Number (ESN) when operating asynchronously. The setup path inserted a 4‑byte seqhi slot but completion callbacks rebuilt the layout without accounting for it, causing the header to read or compare wrong bytes. This mismatch prevents the AH integrity check from succeeding, resulting in dropped packets and effectively denial of service on IPv4 traffic that uses AH+ESN. The issue was demonstrated on an IPv4 UML setup with forced async hmac(sha1). While the same code path exists for IPv6, the CVE description notes that IPv6 AH+ESN was not exercised at runtime and has not been tested against real async hardware, so IPv6 impact is inferred but not confirmed.

All systems running Linux kernel versions that enable asynchronous AH processing with ESN are affected. The patch addresses both net/ipv4/ah4.o and net/ipv6/ah6.o. Specific affected versions are not enumerated in the report, so any kernel that implements AH+ESN asynchronously and has not incorporated this fix is vulnerable.

The vulnerability is network‑based and requires the ability to send crafted AH packets with ESN to a target, which most systems can do over the public Internet or internal network. Based on the description, it is inferred that the attacker would need to send these packets in order to trigger packet loss. An attacker could force packet loss, disrupting connectivity without any authentication or privilege escalation. The CVSS score is 5.5, reflecting a medium severity. The EPSS score is < 1%, indicating a very low likelihood of exploitation, and the CVE is not listed in the CISA KEV catalog. Given that the failure is tied to kernel packet processing, the impact is high for systems where AH+ESN is routinely used.