The vulnerability in the Linux kernel's xfrm subsystem concerns the iptfs_consume_frags() function, which transfers paged fragments from one socket buffer to another but does not propagate the SKBFL_SHARED_FRAG flag. This flag indicates that fragments are shared and backed by read-only page-cache pages, which is critical for the Encapsulating Security Payload (ESP) to determine if in-place encryption is safe. Failure to preserve this flag can lead to incorrect encryption handling. The fix involves applying the same two-line patch previously used in skb_try_coalesce() to ensure the shared-frag marker is preserved during fragment consumption.

The vulnerability can cause incorrect handling of shared fragments in the Linux kernel's networking stack, potentially leading to improper encryption operations in ESP. This could result in confidentiality, integrity, and availability impacts as indicated by the CVSS vector (Confidentiality: High, Integrity: High, Availability: High). However, no known exploits in the wild have been reported.

A fix has been applied to the Linux kernel source code to preserve the SKBFL_SHARED_FRAG flag in iptfs_consume_frags(), similar to the fix for CVE-2026-46300. Users and administrators should update their Linux kernel to a version that includes this fix. Patch status is not explicitly stated in the provided data; therefore, check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply the update accordingly.