Executive brief
The Linux kernel's network packet handling code has a flaw in how it manages zero-copy memory buffers when packets are cloned. When network packets are duplicated during processing (especially in scenarios like Open vSwitch packet forwarding), the kernel incorrectly modifies shared state that affects the original packet. This can lead to memory corruption and unauthorized access to encrypted data during local packet delivery.
Technical details
The vulnerability is a data race / shared state corruption bug in the network packet buffer management code. The `skb_tx_error()` function modifies zerocopy flags in shared packet metadata (skb_shinfo) without checking if the packet buffer is a clone. When a packet clone is created and later experiences a transmission error, the function incorrectly clears flags that affect the original (still in-flight) packet. This is triggered in Open vSwitch when packet recirculation clones a packet while the original continues processing. The race condition allows a cloned packet's flow miss to corrupt the original packet's memory state, enabling decryption-in-place attacks over unowned memory fragments. The fix adds a check to skip the zerocopy state cleanup for cloned packets, since the cleanup will occur naturally when the last reference to shared data is released.
Affected products
- Linux Linux kernel Multiple versions (approximately 4.0 through 7.x based on stable tree references)
Timeline
- 2026-09-11: disclosed: Vulnerability disclosed to NVD
- 2026-09-07: patched: Fix committed to stable kernel tree