In the Linux kernel, the function skb_zerocopy() copies fragment descriptors from one skb to another but fails to propagate the SKBFL_SHARED_FRAG flag. When a destination skb incorrectly reports that it has no shared fragments, later in‑place writers assume the buffer is safe to modify. An attacker who can inject crafted networking traffic that uses nfnetlink_queue or an openvswitch upcall can cause the kernel to write into the page cache backing a root‑owned read‑only file, effectively giving the attacker write access to protected data and allowing privilege escalation.

All Linux kernel releases before the commit that added flag propagation for skb_zerocopy are affected. Any distribution shipping a kernel lacking that commit is potentially impacted, regardless of other vendor‑specific patches.

The flaw is exploitable locally; an unprivileged user must be able to send crafted packets that trigger the vulnerable code paths. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Attackers can take advantage of the broken flag to perform in‑place writes, which can lead to privilege escalation or data tampering. The risk is significant for systems that allow unprivileged users to send packets via nfnetlink_queue or openvswitch upcalls.