diff --git a/pkg/tcpip/stack/iptables.go b/pkg/tcpip/stack/iptables.go
index 2f2cfc438..a9aba469d 100644
--- a/pkg/tcpip/stack/iptables.go
+++ b/pkg/tcpip/stack/iptables.go
@@ -315,7 +315,7 @@ func (it *IPTables) shouldSkipOrPopulateTables(tables []checkTable, pkt *PacketB
 // This is called in the hot path even when iptables are disabled, so we ensure
 // that it does not allocate. Note that called functions (e.g.
 // getConnAndUpdate) can allocate.
-// +checkescape
+// TODO(b/233951539): checkescape fails on arm sometimes. Fix and re-add.
 func (it *IPTables) CheckPrerouting(pkt *PacketBuffer, addressEP AddressableEndpoint, inNicName string) bool {
 	tables := [...]checkTable{
 		{
@@ -353,7 +353,7 @@ func (it *IPTables) CheckPrerouting(pkt *PacketBuffer, addressEP AddressableEndp
 // This is called in the hot path even when iptables are disabled, so we ensure
 // that it does not allocate. Note that called functions (e.g.
 // getConnAndUpdate) can allocate.
-// +checkescape
+// TODO(b/233951539): checkescape fails on arm sometimes. Fix and re-add.
 func (it *IPTables) CheckInput(pkt *PacketBuffer, inNicName string) bool {
 	tables := [...]checkTable{
 		{
@@ -393,7 +393,7 @@ func (it *IPTables) CheckInput(pkt *PacketBuffer, inNicName string) bool {
 // This is called in the hot path even when iptables are disabled, so we ensure
 // that it does not allocate. Note that called functions (e.g.
 // getConnAndUpdate) can allocate.
-// +checkescape
+// TODO(b/233951539): checkescape fails on arm sometimes. Fix and re-add.
 func (it *IPTables) CheckForward(pkt *PacketBuffer, inNicName, outNicName string) bool {
 	tables := [...]checkTable{
 		{
@@ -425,7 +425,7 @@ func (it *IPTables) CheckForward(pkt *PacketBuffer, inNicName, outNicName string
 // This is called in the hot path even when iptables are disabled, so we ensure
 // that it does not allocate. Note that called functions (e.g.
 // getConnAndUpdate) can allocate.
-// +checkescape
+// TODO(b/233951539): checkescape fails on arm sometimes. Fix and re-add.
 func (it *IPTables) CheckOutput(pkt *PacketBuffer, r *Route, outNicName string) bool {
 	tables := [...]checkTable{
 		{
@@ -467,7 +467,7 @@ func (it *IPTables) CheckOutput(pkt *PacketBuffer, r *Route, outNicName string)
 // This is called in the hot path even when iptables are disabled, so we ensure
 // that it does not allocate. Note that called functions (e.g.
 // getConnAndUpdate) can allocate.
-// +checkescape
+// TODO(b/233951539): checkescape fails on arm sometimes. Fix and re-add.
 func (it *IPTables) CheckPostrouting(pkt *PacketBuffer, r *Route, addressEP AddressableEndpoint, outNicName string) bool {
 	tables := [...]checkTable{
 		{