The Linux kernel networking code incorrectly drops the SKBFL_SHARED_FRAG flag when coalescing packet buffers. This causes subsequent in‑place operations, such as ESP packet decryption, to assume ownership of a buffer that is actually shared or backed by the page cache. If the decryption writes directly over these shared fragments, the kernel can overwrite memory outside the intended bounds, leading to kernel corruption and crash.

Linux kernel releases 7.1 RC1 through RC4 and any downstream derivatives that are still running those versions are vulnerable. The bug is present in the core networking code, so any distribution shipping one of these kernels without the correction is affected.

The CVSS score of 7.8 classifies the issue as high severity. The EPSS score of 4% indicates a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation at this time. The likely attack vector is crafting specialized network traffic that triggers the skb_try_coalesce path, potentially from either an internal or external source. Successful exploitation would result in kernel destabilization through memory corruption or potential denial of service.