The Linux kernel Encapsulating Security Payload (ESP) module incorrectly handles zero‑copy managed fragments when ESP rewrites the socket buffer fragment array. The flaw causes the kernel to drop page references for fragments owned by the user buffer without first downgrading them, resulting in a use‑after‑free of the zero‑copy pages and a continuous memory leak. This behavior aligns with CWE‑911, which involves improper buffer integrity.

All Linux kernels that contain the vulnerable ESP code path are impacted, including the upstream generic kernel and any derivative kernels that have not yet applied the patch that introduces skb_zcopy_downgrade_managed() before ESP mutates the fragment list. Systems running IPsec or ESP over IPv4 or IPv6 with the vulnerable kernel revision are at risk, regardless of distribution.

The CVSS score of 7.8 indicates a high‑severity kernel memory corruption flaw, and the EPSS score of < 1% reflects a very low, though non‑zero, likelihood of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is network‑based: an attacker who can send crafted ESP packets to a host with IPsec enabled may trigger the flaw, potentially causing a kernel crash or privilege escalation.