skbuff Zerocopy UAF

Vulnerability analysis

When the kernel's skb zerocopy helper encounters a memory allocation failure while orphaning fragments, it calls a destructive error-reporting function on the source skb — a skb it does not own. This prematurely completes the source skb's zerocopy state, telling the original producer its buffers are free, and clears the shared-fragment ownership flag. In the Open vSwitch datapath, the skb is not freed on this error: the action execution loop ignores the failure return value and continues forwarding the same skb through remaining flow actions. With the ownership flag cleared, a later ESP/IPsec delivery will decrypt in place over fragments that may have already been freed and reused by the producer, causing use-after-free memory corruption. The fix removes the destructive error-reporting call from the copy helper entirely, leaving error reporting to the two callers (nfnetlink_queue and Open vSwitch) which already handle it on their own drop paths. The vulnerability is reachable from the network by an unauthenticated attacker sending packets through an OVS bridge configured with a userspace upcall action that is not the final action in the flow, though triggering the error path requires memory pressure and the full corruption scenario additionally requires an ESP/IPsec delivery path on the same host.