CVE-2026-90049

A flaw was found in the Linux kernel's networking subsystem. When the skb_zerocopy() function fails to orphan fragments, it incorrectly calls skb_tx_error() on the source sk_buff (skb). This premature completion of the zerocopy user argument and clearing of the SKBFL_SHARED_FRAG flag can lead to a condition where the kernel's IPsec (Internet Protocol Security) component attempts to decrypt data into memory regions that are no longer privately owned by the skb. This could result in data corruption or information disclosure.

This flaw is rated as having an Important impact because, although exploiting the condition requires a complex sequence of networking events such as failed userspace upcalls followed by in-kernel decryption, successful exploitation can lead to kernel memory corruption or exposure of confidential memory buffers. Enterprise deployments that route traffic through virtual switching layers like Open vSwitch alongside IPsec processing are primarily at risk. Unprivileged local users cannot easily trigger this condition on standard configurations without control over specific networking flows and packet lifecycles.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.