A bug in the Linux kernel’s Open vSwitch (OVS) zero‑copy packet processing path causes skb_tx_error() to be invoked on a packet that is about to be dropped, but that packet is still forwarded through additional flow actions. The error path clears the SKBFL_SHARED_FRAG flag on the skb, which ESP‑in‑UDP decryption relies on to gate in‑place authenticated encryption on page‑cache fragments. When the flag is removed, the decrypt routine overwrites pages that it does not own, providing an attacker with an unprivileged page‑cache write primitive.

Affected hosts are Linux kernel installations that include the OVS zero‑copy code path before the fix that moves skb_tx_error() into the drop branch. The vulnerability is present regardless of the kernel release series; any kernel containing OVS with zero‑copy enabled before the specific patch is at risk. Identification requires checking for the presence of the OVS module or the commit that introduces the bug.

The CVSS score of 7.1 indicates a high‑severity flaw. The EPSS score is less than 1 % and the vulnerability is not listed in CISA’s KEV catalog, suggesting low active exploitation risk at this time. However, the flaw gives an attacker a reliable page‑cache write capability if they can send crafted traffic through an affected OVS bridge, which could lead to privilege escalation or data tampering. The attack vector is likely remote, originating from network traffic that traverses the OVS data path.