A memory management flaw in the Linux kernel IPsec (ESP) subsystem could allow a local attacker to achieve privilege escalation or system instability.

The vulnerability exists in the esp_ssg_unref function, which fails to verify if an skb carries managed fragments (SKBFL_MANAGED_FRAG_REFS) before attempting to drop page references. This improper handling causes the kernel to underflow page reference counts for managed fragments, potentially leading to the premature freeing of memory currently in use by the system.

The flaw carries a CVSS score of 7.8, reflecting its potential for high impact on system integrity and availability. Because this vulnerability allows for memory corruption at the kernel level, a local attacker with low privileges could potentially exploit this to crash the system, cause data corruption, or elevate privileges to gain control over the host. In environments where multi-tenancy or untrusted local users are present, this poses a significant risk to the security boundary of the operating system.

Immediate Action: Update the Linux kernel to version 7.2.6 or later, or apply the upstream patches provided in the Linux stable git tree.

Proactive Monitoring: Monitor system logs for kernel oops or panic events, which may indicate that this memory corruption bug has been triggered by an exploit attempt.

Compensating Controls: Restrict local shell access to the system to only trusted users, as this vulnerability requires local access to the affected kernel to trigger.

Public Exploit Available: No

Given the severity of potential kernel-level memory corruption, administrators should prioritize patching the Linux kernel across all affected environments. While the exploit requires local access, the ability to cause system-wide instability or privilege escalation necessitates prompt remediation. Ensure that kernel updates are tested in a staging environment and deployed according to your organization's standard update cycle.