The Linux kernel's xfrm_state_mtu function performs arithmetic on unsigned 32-bit integers involving header length, authentication size, and network adjustments subtracted from a small MTU value. An attacker can exploit this by installing an IPv4 ESP tunnel Security Association with a large authentication key and a small MTU, causing the arithmetic to underflow to a near-2^32 value. This underflow leads to a negative value assigned to esp.tfclen, which is then sign-extended and used as a size parameter in memset, resulting in a massive out-of-bounds write at the end of a socket buffer. The vulnerability is mitigated by adding an underflow check that causes the sendmsg operation to fail with ENETUNREACH, preventing the out-of-bounds write.

An attacker with the ability to configure an IPv4 ESP tunnel can trigger a large out-of-bounds memory write in the kernel, potentially leading to memory corruption. This could cause system instability or crashes. However, the kernel now prevents this by checking for underflow and returning an error, thus blocking the exploit path.

The Linux kernel has been updated to include an underflow check in xfrm_state_mtu that causes the sendmsg call to fail with ENETUNREACH, preventing the out-of-bounds write. Users should apply the official kernel updates that include this fix. Patch status is not yet confirmed in the provided data — check the vendor advisory for current remediation guidance.