CVE-2026-80977

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: don't touch shared zerocopy state in skb tx error()

skb tx error() completes the zerocopy uarg and clears SKBFL ALL ZEROCOPY, and skb zcopy downgrade managed() clears SKBFL MANAGED FRAG REFS. Both live in skb shinfo(), which every clone shares, while the caller only owns the reference it is about to drop. Through a clone it tells the producer its pages are free and drops SKBFL SHARED FRAG for an skb that is still in flight.

Open vSwitch reaches this with a non-last OVS ACTION ATTR RECIRC: clone execute() sends a skb clone() into ovs dp process packet() while do execute actions() keeps forwarding the original, and skb clone() does not privatise the frags here -- skb orphan frags() returns early on SKBFL DONT ORPHAN. A flow miss on the clone then strips the marker from the packet still being forwarded, and a later local ESP delivery decrypts in place over frags it does not own privately.

Skip it for a cloned skb. Nothing is lost: skb release data() clears the zerocopy state once the last reference to the shared data goes.