In the Linux kernel’s IPsec (xfrm) subsystem, the xfrm_state_mtu function computes the Ethernet‑layer maximum transmission unit using unsigned 32‑bit arithmetic. When an attacker supplies a large ESP authentication key, a very small MTU, and an unusually large tfcpad value, the calculation underflows to a value near 2^32. This value is then used as a signed integer in esp_output_fill_trailer, causing memset to be passed a very large size (~16 EB). The result is an out‑of‑bounds write that corrupts kernel memory and typically aborts the process, producing a denial‑of‑service condition. The vulnerability is a classical uncontrolled write (CWE‑787) and is not directly an escalation primitive, but the resulting memory corruption can trigger a kernel crash that affects the entire system.

All releases of the mainline Linux kernel that contain the vulnerable xfrm_state_mtu code are affected; no specific version constraints were listed. The flaw resides in the core xfrm subsystem that processes ESP traffic, so any kernel built from the upstream source with this code is potentially susceptible. Security‑sensitive environments that allow local users to configure IPsec tunnels are therefore exposed.

The CVSS score of 7.8 indicates high severity, while the EPSS score of <1 % shows a low current exploitation likelihood. The vulnerability requires local access to configure an ESP tunnel with the specific offset parameters, making it relevant mainly for multi‑tenant or shared consoles where untrusted users can create network interfaces. While the assault cannot directly raise privileges, the kernel memory corruption can lead to a system crash and reboot, constituting a denial‑of‑service vector.