UBUNTU-CVE-2026-98368: Use After Free

In the Linux kernel, the following vulnerability has been resolved: esp: downgrade zerocopy managed frags before mutating skb frags On the out-of-place output path (esp->inplace == false) ESP rewrites the skb frag array: espoutputhead() appends a trailer frag and espoutputtail() replaces the frags with a destination page, both referenced with getpage(). When the skb carries zerocopy managed frags (SKBFLMANAGEDFRAGREFS) the payload frags are owned by the ubuf and must not be referenced or unreferenced individually, but ESP mutates the frag array without ever downgrading the skb. This breaks the managed-frag invariant two ways: - espssgunref() walks the source scatterlist and drops a page reference for every frag, including the ubuf-owned payload frags, pushing their refcount below the GUP pin bias while the pages are still pinned, i.e. a use-after-free of the zerocopy pages; - espoutputtail() installs its destination page as frag 0 with getpage() but leaves SKBFLMANAGEDFRAGREFS set, so skbreleasedata() takes the skipunref branch and never drops that reference, leaking the x->xfrag page at packet rate. Fix this the way every other frag-mutating site does (ipappenddata(), ip6appenddata(), tcpsendmsglocked()) and call skbzcopydowngrademanaged() before ESP touches the frag array: it takes a real reference on each existing frag and clears SKBFLMANAGEDFRAGREFS, so the per-frag unref in espssgunref() and the frag release in skbreleasedata() are both balanced and no mixed-ownership frag array is left behind.