Fedora Account System
Red Hat Associate
Red Hat Customer
NFQUEUE constructs packet-bearing netlink messages with `skb_zerocopy()`. The helper can transfer references to a page-backed source head and nonlinear fragments into the destination skb used for the `NFQA_PAYLOAD` attribute. Although the page references and fragment descriptors are retained, the helper does not propagate the source skb's `SKBFL_SHARED_FRAG` ownership marker. `SKBFL_SHARED_FRAG` tells later consumers that the fragment storage is not private to the skb. ESP input checks `skb_has_shared_frag()` when deciding whether nonlinear packet data must pass through `skb_cow_data()` before authenticated decryption. If an intermediate transfer retains the backing pages while erasing the marker, ESP can select an in-place decryption path for storage that is not privately owned by the destination skb. The demonstrated packet composition creates a splice-backed UDP skb containing bytes from a file opened read-only, queues the packet to NFQUEUE, taps the resulting netlink skb through a netlink tap and `nlmon`, rewrites only the linear prefix into a valid authenticated ESP packet using traffic-control `pedit`, and redirects the packet to loopback. The nonlinear file-backed fragment remains attached. ESP then performs authenticated decryption over the retained page-cache-backed bytes. The resulting write crosses ordinary file-permission boundaries: an unprivileged process can modify bytes belonging to a file that it can read but cannot open for writing.
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:93412 https://access.redhat.com/errata/RHSA-2026:93412
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:93437 https://access.redhat.com/errata/RHSA-2026:93437
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:93436 https://access.redhat.com/errata/RHSA-2026:93436
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:94109 https://access.redhat.com/errata/RHSA-2026:94109
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:94303 https://access.redhat.com/errata/RHSA-2026:94303
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:94438 https://access.redhat.com/errata/RHSA-2026:94438
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:94477 https://access.redhat.com/errata/RHSA-2026:94477
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:94508 https://access.redhat.com/errata/RHSA-2026:94508
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:94558 https://access.redhat.com/errata/RHSA-2026:94558
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:94596 https://access.redhat.com/errata/RHSA-2026:94596
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:94996 https://access.redhat.com/errata/RHSA-2026:94996
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:95556 https://access.redhat.com/errata/RHSA-2026:95556
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:95721 https://access.redhat.com/errata/RHSA-2026:95721