CVE-2026-80977

A flaw was found in the Linux kernel's networking subsystem. The skb_tx_error() function improperly handles shared zerocopy state in socket buffers (skbs). When a cloned skb is processed, it can prematurely signal that its pages are free and drop shared fragment flags while the original skb is still in use. This can lead to a scenario where a local ESP (Encapsulating Security Payload) delivery decrypts data into memory fragments that it does not privately own, potentially resulting in information disclosure.

This vulnerability is rated as having a Moderate impact because exploitation requires a complex set of timing conditions and specific networking configurations—specifically involving socket buffer cloning under Open vSwitch packet recirculation alongside encrypted IPsec ESP traffic—limiting the attack vector to authenticated local users. Under these strict prerequisites, an unprivileged user cannot reliably trigger the improper memory state, minimizing the risk of unauthorized data disclosure. Typical deployments that do not pair packet recirculation with local IPsec termination paths remain unaffected by this condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.