The Linux kernel networking stack incorrectly handles shared‑fragment flags when fragment descriptors are transferred between socket buffers. Two helper functions, __pskb_copy_fclone() and skb_shift(), fail to set the SKBFL_SHARED_FRAG bit in the destination skb's shinfo flags. As a result, the destination skb reports no shared fragments while still pointing to externally‑owned or page‑cache‑backed pages. Writers that rely on skb_has_shared_frag() to decide whether copy‑on‑write is required, such as the ESP decryption path and nft "dup to <local>" rules, may skip necessary safeguards, allowing an attacker to write into page‑cached memory that belongs to read‑only kernel files.

All releases of the Linux kernel are vulnerable until the patch that propagates the flag is applied. The defect exists in the core networking code and is present across all distributions and kernel versions; verification of the presence of the missing flag behavior should be performed on any kernel before the commit that adds the fix.

The CVSS score of 8.8, combined with an EPSS below 1% and non‑listing in CISA's KEV catalog, indicates a high‑severity vulnerability with a low probability of exploitation. Successful exploitation, however, would allow an unprivileged user to write into the page cache of a root‑owned read‑only file via crafted network traffic, potentially leading to privilege escalation. An attacker must be able to influence the kernel’s networking stack—typically by causing ESP or nft duplication paths—to trigger the bug.