CVE-2026-80977

A flaw in the Linux kernel networking stack allows skb_tx_error() to modify zerocopy state held in skb_shinfo(), which is shared with every clone, so a cloned skb can prematurely tell the zerocopy producer its pages are free and drop SKBFL_SHARED_FRAG while the original packet is still in flight. The bug is reachable through Open vSwitch when a non-last OVS_ACTION_ATTR_RECIRC action feeds an skb_clone() into ovs_dp_process_packet() while do_execute_actions() keeps forwarding the original; a flow miss on the clone strips the zerocopy markers from the still-in-flight packet. A later local ESP (IPsec) delivery then decrypts in place over fragments it does not privately own, causing kernel memory corruption with high impact on confidentiality, integrity and availability (CVSS 3.1: 7.8; local attack vector, low privileges required, no user interaction). Practical exposure is limited to hosts running the OVS kernel datapath with recirculation actions combined with zerocopy transmit and local ESP delivery, not generic Linux systems. No public PoC exists, the issue is not in CISA's KEV, and no exploitation has been reported.

What to do: Update to a kernel release or vendor backport containing the upstream fix that skips touching shared zerocopy state for cloned skbs in skb_tx_error(); track your distro's stable kernel updates for the patch. Until patched, avoid OVS pipelines where a recirculation action is not the last action on zerocopy-transmitted packets that also undergo local ESP/IPsec delivery, and audit OVS hosts with tunnels and IPsec for kernel crashes or page-refcount anomalies.