The Linux kernel’s espintcp subsystem contains a memory‑safety flaw where a partially sent packet is incorrectly reassigned to a new send request while the original transmission is still in progress. This reuse of the in‑flight state can leave stale data attached to a new message, leading to an out‑of‑bounds read in the send path. The result is leakage of kernel memory contents to the user performing the send, which can reveal sensitive data but does not corrupt memory or provide privileged escalation.

All Linux kernel releases that include the espintcp module prior to the protective change are vulnerable. This encompasses the generic Linux kernel and the Linux 7.1 series rc1 through rc7, as indicated by the CPE entries. Any distribution that builds its kernel with espintcp enabled inherits this flaw.

The CVSS score of 7.8 classifies the flaw as high severity, while the EPSS score of less than 1 % indicates a low exploitation probability. The vulnerability is not listed in CISA KEV. Exploitation requires that espintcp traffic be actively in transit and a new message be queued before the prior one completes. The most likely threat comes from processes that can generate such traffic, such as VPN clients that use espintcp; the issue does not provide privilege escalation or remote code execution, only information disclosure.