iptfs_consume_frags() is a Linux kernel function that copies packet fragments from one socket buffer to another, but it does not propagate the SKBFL_SHARED_FRAG flag that marks fragments backed by read‑only page‑cache pages. When the ESP subsystem later attempts in‑place encryption, it uses this flag to decide whether the data can safely be lost the data is not shared and may proceed with encryption, potentially corrupting or exposing sensitive packet payloads. This improper handling can therefore lead to data corruption and confidentiality loss for ESP traffic.

All Linux kernel configurations that include the xfrm/iptfs code path but have not applied the patch are affected. The vulnerability applies to any kernel build that contains the iptfs_consume_frags() path prior to the commit that added the two‑line fix (c885d111ed9f5a0a1f3cc4e87a50db6518abaa6c). No specific kernel release numbers are listed, so any kernel version lacking this commit may be vulnerable.

EPSS score is less than 1% and the vulnerability is not listed in CISA's KEV not provided. The likely attack vector is exploiting fragmented traffic handled by the ESP subsystem. Based on the description, it is inferred that an attacker would need to influence or observe ESP‑fragmented traffic, which typically requires local With considered low to moderate until further evidence or exploit availability emerges.