The flaw occurs when a queued ESP‑in‑TCP packet is processed after its original ingress device has been removed. The kernel restores the packet’s device pointer from a saved index, but the lookup can return NULL when the device no longer exists. The code then attempts to use this NULL pointer while building the route, causing a dereference of a NULL pointer and a kernel crash. An attacker can trigger the crash by sending specially crafted ESP‑in‑TCP traffic, leading to a denial‑of‑service on the affected host.

All Linux kernel releases that implement the xfrm framework for ESP‑in‑TCP are potentially impacted. No specific version range is listed, so any kernel build that compiles the xfrm module may be vulnerable. Administrators should verify whether their system uses ESP‑in‑TCP and, if so, ensure the kernel is updated to a release that contains the patch.

The vulnerability is not listed in CISA’s KEV catalog and EPSS information is not available, but the nature of a NULL dereference in kernel code indicates a high‑severity flaw. An attacker with network access can craft a packet that triggers the failure, causing a crash that could be leveraged for denial‑of‑service or, in some scenarios, local privilege escalation if the crash is exploitable for code execution. The lack of public exploits does not diminish the inherent risk of a kernel‑level crash.