The vulnerability in the Linux kernel's ESP (Encapsulating Security Payload) code arises in the esp_output_tail() function when esp->inplace is false. During processing, old skb page fragments are replaced with new pages, and scatterlists are built from these fragments. If the second skb_to_sgvec() call fails, the error handling path frees temporary memory but does not release references to the old page fragments, causing a reference leak. The fix adds a boolean parameter to esp_ssg_unref() to unconditionally unreference the source scatterlist fragments on error, addressing the leak. This flaw exists identically in both esp4 and esp6 code paths.

The vulnerability leads to a page fragment reference leak in the Linux kernel's ESP implementation, which can cause resource exhaustion and potential denial of service due to unreleased memory references. There is no impact on confidentiality or integrity reported. The CVSS score is 7.5 (high) with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

A fix for this vulnerability has been implemented in the Linux kernel source code. Users and administrators should apply the official kernel updates that include this patch. Since this is not a cloud service, remediation depends on deploying the updated kernel versions. Patch status is not explicitly stated in the provided data; therefore, check the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.