Linux kernel skb_zerocopy() error-path flaw risks UAF/memory corruption via Open vSwitch
The Linux kernel's skb_zerocopy() helper destructively calls skb_tx_error() on the source socket buffer when skb_orphan_frags() fails, completing the source skb's zerocopy uarg and clearing the SKBFL_SHARED_FRAG page-ownership flag on a buffer the helper does not own. On the Open vSwitch OVS_ACTION_ATTR_USERSPACE path the skb is not freed after this error - do_execute_actions() ignores output_userspace()'s return value and keeps forwarding the same skb - so zerocopy buffers can be signaled as free while still in flight, and because SKBFL_SHARED_FRAG is cleared, esp_input() can decrypt in place over page fragments the skb does not privately own. A local attacker able to push traffic through an affected Open vSwitch datapath or an nfnetlink_queue (NFQUEUE) flow and trigger a frag-orphaning failure can cause use-after-free conditions and kernel memory/data corruption, with kernel-level confidentiality, integrity and availability impact (CVSS 9.3, local vector, scope changed). Any Linux system with the pre-fix kernel code is affected, with realistic trigger exposure on hosts running the Open vSwitch kernel datapath or NFQUEUE userspace queuing; the source data provides no specific vulnerable or fixed version numbers. No exploitation is known, no public proof-of-concept exists, and the issue is not listed in CISA KEV.
· Linux kernel (net/skbuff skb_zerocopy(), reachable via Open vSwitch kernel datapath and nfnetlink_queue)mass
Linux kernel ESP-in-UDP decrypts in place over shared splice pages (CWE-123)
CVE-2026-43284 is a write-what-where memory-safety flaw (CWE-123) in the Linux kernel's xfrm/ESP (IPsec) code: the IPv4/IPv6 UDP datagram send paths fail to mark pages spliced into a UDP skb with SKBFL_SHARED_FRAG when MSG_SPLICE_PAGES attaches pipe pages, so the ESP input path wrongly treats the packet as privately owned and decrypts it in place over memory the skb does not exclusively own. It is triggered when locally generated UDP traffic built from spliced pipe pages is processed by the ESP decryption path, typically in IPsec NAT-traversal (ESP-in-UDP, UDP port 4500) configurations; the in-place decrypt can corrupt or expose data still referenced by the pipe or other owners of those shared pages. A local, low-privileged attacker can thereby cause high-severity confidentiality, integrity, and availability impact that extends beyond the packet itself (CVSS 3.1: 8.8, scope changed); no remote or unauthenticated trigger is described. Any Linux system running a kernel with the vulnerable UDP splice and ESP-in-UDP paths is affected, most importantly IPsec VPN gateways and clients; the advisory lists no affected version ranges. No public proof-of-concept or confirmed in-the-wild exploitation is known (not on CISA KEV), but EPSS assigns a 93.2% probability of exploitation within 30 days (100th percentile), so patching should not be deferred.
· Linux kernelmass
Linux kernel Open vSwitch error-path bug enables local page-cache writes
The Linux kernel's Open vSwitch module mishandles failures of the USERSPACE action: queue_userspace_packet()'s error path calls skb_tx_error() on an skb it has only borrowed (not dropped), stripping the SKBFL_SHARED_FRAG zerocopy flag from a packet that do_execute_actions() keeps forwarding through the rest of the flow's actions. On a MSG_ZEROCOPY packet carrying page-cache fragments, that flag is what forces the ESP input path (esp_input()) to copy the data before decrypting in place; once stripped, a locally delivered ESP-in-UDP packet decrypts in place over shared page-cache pages the sender does not own, giving an unprivileged local user a page-cache write primitive (the 'Fragnesia' technique). Successful exploitation gives an attacker high confidentiality, integrity, and availability impact — for example, tampering with page-cache-backed file contents to escalate privileges (CVSS 3.1: 7.8, local attack vector, low privileges required). Affected products are Linux kernels containing the openvswitch module, with the flawed error path present since commit 36d5fe6a0007 (2018) but only becoming exploitable once esp_input() began relying on SKBFL_SHARED_FRAG to gate in-place decryption. No public proof-of-concept is known and the flaw is not on CISA's KEV; exploitation requires local code execution plus specific OVS, zerocopy, and ESP-in-UDP conditions.
· Linux kernel (openvswitch module)mass
Out-of-bounds write in Linux kernel AF_RXRPC decryption enables root access
CVE-2026-43500 is a memory-corruption flaw in the Linux kernel's AF_RXRPC (rxrpc) subsystem: the DATA and RESPONSE packet handlers only copy received skbs to a linear buffer before decryption when the skb is marked cloned, so non-cloned skbs that still carry externally owned paged fragments (SKBFL_SHARED_FRAG, e.g. set by splice() into a UDP socket, or skbs with a frag_list) fall through to the in-place decryption path. In that path the shared fragment pages are bound directly into the AEAD/skcipher scatter-gather list via skb_to_sgvec(), so decryption writes into pages shared with other kernel or user contexts, causing out-of-bounds/write-what-where corruption (CWE-787/CWE-123), notably via the splice-into-UDP-socket loopback vector. A local low-privileged attacker who can get the machine to process such rxrpc packets can corrupt kernel memory and escalate to root (CVSS 3.1: 7.8 high, local vector, high confidentiality/integrity/availability impact). Affected systems are Linux kernels with the AF_RXRPC subsystem available — the transport used by the AFS/kAFS network filesystem — which mainstream distribution kernels ship as a module or built-in; no specific affected or fixed version ranges are provided in the data. It is not on CISA's KEV list and the CVE record lists no public PoC, but news reports describe a 'Dirty Frag' local privilege-escalation exploit giving root across major distributions and a released PoC, and EPSS puts the 30-day exploitation probability at about 93% (100th percentile).
· Linux kernelmass
Shared zerocopy state corruption in Linux kernel via Open vSwitch recirculation clones
A flaw in the Linux kernel networking stack allows skb_tx_error() to modify zerocopy state held in skb_shinfo(), which is shared with every clone, so a cloned skb can prematurely tell the zerocopy producer its pages are free and drop SKBFL_SHARED_FRAG while the original packet is still in flight. The bug is reachable through Open vSwitch when a non-last OVS_ACTION_ATTR_RECIRC action feeds an skb_clone() into ovs_dp_process_packet() while do_execute_actions() keeps forwarding the original; a flow miss on the clone strips the zerocopy markers from the still-in-flight packet. A later local ESP (IPsec) delivery then decrypts in place over fragments it does not privately own, causing kernel memory corruption with high impact on confidentiality, integrity and availability (CVSS 3.1: 7.8; local attack vector, low privileges required, no user interaction). Practical exposure is limited to hosts running the OVS kernel datapath with recirculation actions combined with zerocopy transmit and local ESP delivery, not generic Linux systems. No public PoC exists, the issue is not in CISA's KEV, and no exploitation has been reported.
· Linux kernellarge