The Linux kernel function skb_gro_receive() can copy fragments from a source socket buffer into a GRO skb without checking whether either buffer is in zero‑copy mode. When the source skb has the SKBFL_MANAGED_FRAG_REFS flag, its fragment pages are not reference counted, so appending those fragments to another skb can leave dangling references. This leads to a use‑after‑free that can corrupt kernel memory, allowing an attacker to execute arbitrary code or crash the system, a classic example of CWE‑416. The vulnerability is a direct result of merging zero‑copy skbs without proper reference counting.

All Linux kernels that have not yet incorporated the patch from commit 1f9c828, regardless of distribution or version. The fix is present in the mainline kernel; any system running an unpatched kernel that exposes skb_gro_receive() is affected.

The bug permits an attacker to trigger kernel memory corruption by sending crafted network packets that cause skb_gro_receive() to merge zero‑copy skbs. Due to the high severity of use‑after‑free weaknesses, exploitation could lead to privilege escalation or denial of service. No EPSS score is available, and the vulnerability is not listed in CISA KEV, but the well‑understood mechanism suggests a high likelihood of exploitation in environments where the kernel is reachable by untrusted network traffic. No public exploits are documented yet, but the vulnerability is technically exploitable with the right conditions.