Bug 2559835

Summary: kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege Escalation Vulnerability
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A vulnerability exists in the Linux kernel's skb_zerocopy() function in net/core/skbuff.c due to improper handling of the SKBFL_SHARED_FRAG flag when transferring shared memory fragments between socket buffers. As a result, the destination socket buffer retains references to shared, page-backed memory without preserving the flag that identifies the fragments as shared. This can cause the IPsec ESP processing path to decrypt packet data in place, modifying page-cache contents belonging to files that the attacker can read but does not have permission to modify. A local unprivileged attacker may exploit this flaw to corrupt sensitive file contents and potentially escalate privileges.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-23 13:51:53 UTC 
NFQUEUE constructs packet-bearing netlink messages with `skb_zerocopy()`.
The helper can transfer references to a page-backed source head and nonlinear
fragments into the destination skb used for the `NFQA_PAYLOAD` attribute.
Although the page references and fragment descriptors are retained, the helper
does not propagate the source skb's `SKBFL_SHARED_FRAG` ownership marker.

`SKBFL_SHARED_FRAG` tells later consumers that the fragment storage is not
private to the skb. ESP input checks `skb_has_shared_frag()` when deciding
whether nonlinear packet data must pass through `skb_cow_data()` before
authenticated decryption. If an intermediate transfer retains the backing
pages while erasing the marker, ESP can select an in-place decryption path for
storage that is not privately owned by the destination skb.

The demonstrated packet composition creates a splice-backed UDP skb containing
bytes from a file opened read-only, queues the packet to NFQUEUE, taps the
resulting netlink skb through a netlink tap and `nlmon`, rewrites only the
linear prefix into a valid authenticated ESP packet using traffic-control
`pedit`, and redirects the packet to loopback. The nonlinear file-backed
fragment remains attached. ESP then performs authenticated decryption over the
retained page-cache-backed bytes.

The resulting write crosses ordinary file-permission boundaries: an
unprivileged process can modify bytes belonging to a file that it can read but
cannot open for writing.
Comment 2 Jon Orris 2026-11-01 21:40:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:93412 https://access.redhat.com/errata/RHSA-2026:93412
Comment 3 Jon Orris 2026-11-02 01:44:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:93437 https://access.redhat.com/errata/RHSA-2026:93437
Comment 4 Jon Orris 2026-11-02 03:50:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:93436 https://access.redhat.com/errata/RHSA-2026:93436
Comment 5 Jon Orris 2026-11-02 23:13:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:94109 https://access.redhat.com/errata/RHSA-2026:94109
Comment 6 Jon Orris 2026-11-03 05:47:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:94303 https://access.redhat.com/errata/RHSA-2026:94303
Comment 7 Jon Orris 2026-11-03 09:03:27 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:94438 https://access.redhat.com/errata/RHSA-2026:94438
Comment 8 Jon Orris 2026-11-03 09:22:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:94477 https://access.redhat.com/errata/RHSA-2026:94477
Comment 9 Jon Orris 2026-11-03 12:30:06 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:94508 https://access.redhat.com/errata/RHSA-2026:94508
Comment 10 Jon Orris 2026-11-03 14:04:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:94558 https://access.redhat.com/errata/RHSA-2026:94558
Comment 11 Jon Orris 2026-11-03 15:40:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:94596 https://access.redhat.com/errata/RHSA-2026:94596
Comment 12 Jon Orris 2026-11-04 04:44:27 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:94996 https://access.redhat.com/errata/RHSA-2026:94996
Comment 13 Jon Orris 2026-11-05 14:13:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:95556 https://access.redhat.com/errata/RHSA-2026:95556
Comment 14 Jon Orris 2026-11-05 21:02:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:95721 https://access.redhat.com/errata/RHSA-2026:95721