CVE-2026-98503

In the Linux kernel, the following vulnerability has been resolved:

packet: use ubuf info completion for TX RING packets

tpacket snd sends skbs with frags pointing into its ring slots. Slots are released when skb->destructor is called.

A call to skb orphan calls skb->destructor before the skb is freed. This can cause the slot to be reused while still linked into the skb.

Switch to standard zerocopy completion (ubuf info) so the slot is only released once all references to the payload are freed or copied. Restore skb->destructor to standard sock wfree.

The ubuf info completion callback can be called with a NULL skb, but only from net zcopy put and related API, used by zerocopy implementations that hold their own reference on the uarg, such as MSG ZEROCOPY. This uarg is only ever completed from skb zcopy clear, so skb is always set.

To prevent userspace from aliasing in-flight state on shared ring slots, allocate tpacket uarg per packet, rather than per slot. This adds a small allocation to the transmit path. Use standard kmalloc to allow backporting to stable kernels.

The uarg holds an sk wmem alloc reference, rather than an sk refcnt reference. packet free tx ring waits on sk wmem alloc before freeing the ring pages. Always allocate vec->deferred for tx ring so page-backed rings also wait on sk wmem alloc when skb copy ubufs drops page refs before calling tpacket ubuf complete.

Drop the tx ring.pg vec test that tpacket destruct skb performed before accessing the slot. The sk wmem alloc reference now guarantees that the slot is valid. The test is also not sufficient by itself, as it reads pg vec without pg vec lock, so it can race with packet set ring.

As a result a slot is released when its payload is copied, which can be before transmission (e.g., in skb orphan frags rx). If copied before skb tx timestamp() is called, no slot timestamp is recorded, similar to when skb orphan() was called early in the datapath before this patch.

Revert the now unused previous skb zcopy .. nouarg infra.

Depends on commit 992cc9f94ca9 ("net/packet: defer vmalloc TX RING free until skbs finish").