A flaw in the Linux kernel’s TCP stack allows two types of skbs—one already queued for transmission and another added after a switch to device or TLS encryption—to be merged during retransmission or SACK processing. The merge removes the encrypted flag from the later skb, resulting in unencrypted data being sent over the network. In systems using PS‑L4 switch protection (psp), the merged skb remains decrypted, so retransmitted data leaves the host in clear text, exposing sensitive traffic. In TLS device‑offload paths, a merged skb that straddles the TLS start marker cannot be processed by software or hardware drivers, causing the connection to stall whenever a retransmission occurs.

Affected systems are all Linux kernel builds that implement the TCP write queue and retransmission logic, specifically those using psp devices that encrypt only skb with skb->decrypted set, and those employing TLS offloading via mlx5, nfp, or funeth drivers. No specific kernel versions are listed, so any current Linux kernel running such devices is potentially impacted.

The vulnerability provides an avenue for an attacker who can influence TCP traffic after the encryption switch—either by sending crafted packets or by exploiting the retransmission behavior—to cause sensitive data to be transmitted in plaintext, violating confidentiality. It also offers a path to denial of service by forcing a reconnect loop in TLS offload configurations. EPSS information is unavailable and the issue is not listed in CISA’s KEV catalog, but the described impact indicates a potentially high severity. The attack vector is inferred to be local or remote network traffic manipulation, as the flaw is triggered during packet retransmission handling in the kernel.