UBUNTU-CVE-2026-80977: High severity ubuntu/linux vulnerability

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror() skbtxerror() completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged() clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo(), which every clone shares, while the caller only owns the reference it is about to drop. Through a clone it tells the producer its pages are free and drops SKBFLSHAREDFRAG for an skb that is still in flight. Open vSwitch reaches this with a non-last OVSACTIONATTRRECIRC: cloneexecute() sends a skbclone() into ovsdpprocesspacket() while doexecuteactions() keeps forwarding the original, and skbclone() does not privatise the frags here -- skborphanfrags() returns early on SKBFLDONTORPHAN. A flow miss on the clone then strips the marker from the packet still being forwarded, and a later local ESP delivery decrypts in place over frags it does not own privately. Skip it for a cloned skb. Nothing is lost: skbreleasedata() clears the zerocopy state once the last reference to the shared data goes.