The Linux kernel networking stack contains a flaw in the shared‑fragment handling logic: two fragment‑transfer helpers—__pskb_copy_fclone() and skb_shift()—do not propagate the SKBFL_SHARED_FRAG flag when moving fragment descriptors from one socket buffer to another. As a result, the destination socket buffer reports no shared fragment while still pointing to shared or page‑cache‑backed pages. Writers that rely on skb_has_shared_frag() to determine whether copy‑on‑write is needed, such as ESP decryption handlers and the nft "dup to <local>" rule, can skip the necessary protection and allow an attacker to write into page‑cached memory that belongs to read‑only files.

All Linux kernel versions are affected; the defect is present in all releases before the patch that adds flag propagation. The vulnerability applies to the core networking code and is not limited to a specific distribution or kernel major version.

The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to influence the kernel networking stack—typically by sending crafted packets that trigger ESP offload or nf_dup paths that depend on the shared‑fragment marker. While the probability of exploitation is low, successful exploitation could permit an unprivileged user to modify kernel‑managed data and potentially achieve privilege escalation. The lack of copy‑on‑write in in‑place writers makes the impact severe if the attacker controls network traffic to the vulnerable host.