The Linux kernel networking subsystem contains a flaw in skb_try_coalesce(). When an skb that carries the SKBFL_SHARED_FRAG flag has its paged fragments transferred to another skb, the flag is omitted from the destination skb. This invalidates the invariant that later stages rely on and may cause in‑place decoders, such as ESP packet handlers, to assume they own the buffer. If this assumption is wrong, the kernel could write decryption output directly over page‑cache backed pages, resulting in an out‑of‑bounds write that corrupts kernel memory, potentially leading to data integrity violations, crashes, or denial‑of‑service. The bug maps to CWE‑123 (buffer size mismatch) and CWE‑787 (out‑of‑bounds write) vulnerability types.

All Linux kernels that have not incorporated the patch that restores the SKBFL_SHARED_FRAG flag on coalesced skbs are affected. The CVE references a commit in the mainline kernel; no specific distribution or version range is provided, so version information is missing. The vulnerability resides in the core networking stack and therefore does not depend on a particular vendor or custom kernel build.

The documented CVSS score of 7.8 classifies this as high severity. The EPSS score is below 1% and it is not listed in the CISA KEV catalog, indicating that no publicly known exploitation campaigns are reported. Based on the description, it is inferred that exploitation would require an attacker to trigger the coalescing path with packets carrying ESP payloads, which could be achieved by sending crafted traffic to the host either internally or externally, implying a potential remote attack vector. Because the bug results in kernel memory corruption, an attacker could achieve a denial‑of‑service or, if they can gain code execution, local privilege escalation.