The vulnerability in the Linux kernel's xfrm ESP (Encapsulating Security Payload) code involved the out-of-place fast path appending the trailer before allocating the destination page fragment. The existing checks separately validated skb->data_len and tail length, but the allocation was done based on their combined length. This mismatch could cause skb_page_frag_refill() to fallback incorrectly, leading to a single page allocation while the destination scatter-gather list still spans the combined skb->data_len. The patch restores the combined-length page gate for both IPv4 and IPv6, rejecting the page-frag fast path when the combined aligned length exceeds a page, thus preventing potential memory handling issues.

The vulnerability could lead to incorrect memory allocation and handling in the Linux kernel's ESP processing path, potentially causing memory corruption or instability. However, no known exploits in the wild have been reported. The exact impact severity is not detailed in the available data.

A fix has been applied to the Linux kernel to restore the combined-length page gate in the xfrm ESP code for both IPv4 and IPv6. Users should apply the official kernel updates that include this patch once available. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for current remediation guidance.