The vulnerability arises because skb_tx_error() clears shared zerocopy state even when the buffer is still being used by a clone. This incorrect handling of SKBFL_SHARED_FRAG and SKBFL_ALL_ZEROCOPY allows a cloned sk_buff to lose the ownership flag while packets are still in flight. In an Open vSwitch context, a non‑last OVS_ACTION_ATTR_RECIRC can trigger a clone that is forwarded while the original is processed. When the clone later fails and the shared sk_buff is modified in this way, an ESP payload may be decrypted in place over fragments that are no longer private, potentially corrupting kernel memory. An attacker who can influence packet content may exploit the resulting memory corruption to achieve privilege escalation or arbitrary code execution inside the kernel.

All Linux kernel releases prior to the kernel commit that introduced the fix (0370da114a9bc044e248b85c6809d1b5e0c1f7f9) are affected. The issue is specifically triggered when Open vSwitch() followed by an OVS_ACTION_ATTR_RECIRC non‑last action. Systems running Open vSwitch on affected kernels should upgrade to kernels that include the patch or use a version of Open vSwitch that prevents the clone path. No specific version numbers are listed in the CNA data; users should consult the kernel maintainers for the fixed release.

The CVSS base score of 7.4 indicates a high so the current exploitation likelihood is unknown; however, the vulnerability can be triggered through crafted network traffic handled by Open vSwitch, which is a common component in virtual networking stacks. The KEV status states it is not listed in the CISA KEV catalog, meaning a weaponized exploit is not publicly confirmed yet. Attackers would need to send malicious packets to the switch; thus the anticipated attack vector is local or remote network traffic. The high severity, coupled with the potential memory corruption path, suggests a need for immediate remediation.