Local privilege escalation via undersized ESP allocation

Heap buffer overflow in Linux kernel IPsec ESP code before 5.16.15 allows local users to gain elevated privileges via a large message. The IPv4 and IPv6 ESP output paths accept a message larger than skb_page_frag_refill can allocate, then write beyond the allocated fragment instead of falling back to copy-on-write. The path requires local low-privileged access; successful exploitation overwrites kernel heap objects, enabling a system crash or arbitrary kernel code execution.