iptfs_consume_frags() is a Linux kernel function that copies packet fragments from one socket buffer to another, but it does not propagate the SKBFL_SHARED_FRAG flag that marks fragments backed by read‑only page‑cache pages. When the ESP subsystem later attempts in‑place encryption, it uses this flag to decide whether the data can safely be lost. The marker indicates whether the data is shared, so without it the ESP subsystem may incorrectly determine that it can freely encrypt or discard the data, potentially corrupting or exposing sensitive packet payloads. This improper handling can therefore lead to data corruption and confidentiality loss for ESP traffic. This vulnerability is a CWE‑821 Information Exposure issue.

All Linux kernel configurations that include the xfrm/iptfs code path but have not applied the patch are affected. The vulnerability applies to any kernel build that contains the iptfs_consume_frags() path prior to the commit that added the two‑line fix (c885d111ed9f5a0a1f3cc4e87a50db6518abaa6c). No specific kernel release numbers are listed, so any kernel version lacking this commit may be vulnerable.

The CVSS score of 9.8 indicates a critical severity. EPSS score is less than 1% and the vulnerability is not listed in CISA's KEV. This is a CWE‑821 Information Exposure issue. The likely attack vector is exploiting fragmented traffic handled by the ESP subsystem. Based on the description, it is inferred that an attacker would need to influence or observe ESP‑fragmented traffic, which typically requires local access or compromised host, representing a low to moderate exploitation likelihood until further evidence or exploit availability emerges.