The vulnerability in the Linux kernel’s TCP stack allows an attacker to cause two distinct skbs—one already queued for transmission and another added after a switch to device or TLS encryption—to be merged during retransmission or selective acknowledgment processing. The merge removes the encrypted flag from the later skb, resulting in that data being sent in cleartext. In configurations that use TLS offload drivers such as mlx5, nfp, or funeth, the merged skb spans the TLS start marker and cannot be handled by the software fallback or hardware offload, causing every retransmission to fail and the connection to stall. This flaw corresponds to the weakness described by CWE‑319, Cleartext Transmission over a Network.

The flaw affects all Linux kernel builds that implement the described TCP write queue and retransmission logic, particularly systems employing device encryption that only encrypt skbs marked as 'decrypted' and those using TLS offload drivers. Because no specific kernel version is cited, any actively deployed kernel that supports these features is potentially impacted.

The CVSS score of 9.1 indicates high severity, while the EPSS score is reported as <1%, suggesting a low probability of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to manipulation of TCP traffic that induces a retransmission or SACK shift—either from a nearby network actor or a compromised host—since the flaw is triggered during the kernel handling of retransmitted packets. While the impact includes privacy exposure and denial of service, the limited exploitation probability and lack of known active exploits imply that the immediate risk is moderate.