In the Linux kernel, the helper that copies packet fragments, iptfs_skb_add_frags, fails to propagate the SKBFL_SHARED_FRAG flag when creating a new socket buffer. When a shared fragment is handled by the ESP decryption routine, the code mistakenly assumes exclusive ownership and performs an in-place decryption that overwrites pages still referenced by the outer packet. This results in kernel-visible memory corruption and can cause a system panic. The issue involves dereferencing a freed pointer (CWE‑821).

Any Linux kernel that includes the unpatched iptfs_skb_add_frags function is potentially impacted. No specific version ranges are listed in the CVE data, so affected releases cannot be precisely identified.

The CVSS score of 9.8 indicates a critical severity, and the vulnerability can lead to a denial‑of‑service via kernel panic. The EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is the receipt of specially crafted network traffic that activates nested transport‑mode IPsec decryption on a packet carrying shared fragments; this inference follows from the description of the affected code path.