Executive brief
The Linux kernel's network stack contains a vulnerability in how it handles packet buffer copying operations. When an error occurs during zero-copy packet transmission, the kernel incorrectly marks buffer pages as free while the packet is still in use by other network processing code, leading to data corruption or system instability. This affects systems using Open vSwitch or other networking features that perform zero-copy operations.
Technical details
The vulnerability exists in the skb_zerocopy() function in net/core/skbuff.c. When skb_orphan_frags() fails during zero-copy buffer processing, the function calls skb_tx_error() on the source packet, which prematurely completes the zerocopy user-arg callback and clears the SKBFL_SHARED_FRAG ownership marker. On Open vSwitch's OVS_ACTION_ATTR_USERSPACE path, the packet is not freed on this error and continues through the network stack. The uarg completion signals to the buffer producer that pages are free while SKBFL_SHARED_FRAG is cleared, causing later ESP encryption/decryption operations to decrypt directly over pages the kernel no longer owns. The fix removes the skb_tx_error() call and delegates error reporting to the callers (nfnetlink_queue and Open vSwitch), who already handle it in their drop paths.
Affected products
- Linux Linux kernel Affected across multiple stable branches including Linux 4.x, 5.x, 6.x, and 7.x series
Timeline
- 2026-09-16: disclosed
- 2026-09-14: patched