The Linux kernel's ESP code in esp_output_tail() improperly handled error conditions during scatterlist construction. When the second skb_to_sgvec() call failed, the code freed temporary memory but did not release references to old page fragments, causing a reference leak. This was due to req->src and req->dst not being initialized at that point, so the unref function needed a parameter to force unconditional release. The flaw existed identically in both esp4 and esp6 implementations. The patch added a boolean parameter to esp_ssg_unref() to ensure proper cleanup on failure paths.

This vulnerability causes a page fragment reference leak in the Linux kernel ESP implementation. While it does not directly lead to code execution or privilege escalation, the leak can cause resource exhaustion over time, potentially degrading system stability or causing denial of service conditions under certain workloads.

A fix has been implemented in the Linux kernel to address this issue by ensuring proper release of page fragment references on error paths in esp_output_tail(). Users should apply the official kernel updates that include this patch. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for current remediation guidance.