The Linux kernel’s xfrm subsystem processes ESP‑in‑TCP packets. When an ESP‑in‑TCP packet contains a transport header offset that exceeds the remaining size after the TCP envelope is trimmed, the kernel fails to reject the packet. Instead, it truncates the offset and activates the skb warning path, which can lead to a kernel warning or fatal error. This vulnerability enables an attacker to send crafted packets that may trigger a kernel crash or instability, effectively providing a denial‑of‑service vector.

Any Linux kernel that builds the xfrm module with ESP‑in‑TCP support is potentially affected. The vulnerability exists in all released kernels that have not incorporated the commit referenced in the advisory. No specific version numbers are cited, so the risk applies to every build that lacks the patch.

Based on the description, it is inferred that an attacker can send crafted ESP‑in‑TCP packets to a vulnerable host, with the likely attack vector being network‑based exploitation through malformed transport header offsets. This causes the kernel to enter the skb warning path and may trigger a crash, resulting in a denial‑of‑service. The CVSS score of 7.5 indicates high severity, while the EPSS score of < 1 % suggests a very low probability of exploitation in the wild. Although no public exploit is known, the kernel nature and possible instability make it an actionable risk. The vulnerability is not listed in CISA’s KEV catalog, but the impact warrants prompt mitigation.