The Linux kernel mac802154 llsec functions llsec_do_encrypt_unauth(), llsec_do_encrypt_auth(), llsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() performed in-place cryptographic transformations on skb data using a scatterlist pointing into the skb's linear data area. On the receive path, cloned skbs shared the same underlying data buffer, leading to corruption when one clone was modified in place. On the transmit path, similar sharing occurred with cloned skb heads. The fix involved calling skb_cow_data() before any in-place crypto operation to ensure the data buffer is unique and safe to modify. Without this, the vulnerability could cause silent data corruption, use-after-free conditions, and kernel crashes under concurrent traffic with security enabled. This pattern aligns with fixes applied in other kernel subsystems like ESP, MACsec, WireGuard, and TIPC.

Exploitation of this vulnerability can lead to silent corruption of data in other skb clones, use-after-free conditions causing memory corruption, and kernel crashes. These issues arise from unsafe in-place modification of shared skb data buffers during cryptographic operations in the mac802154 llsec code path. The impact affects kernel stability and data integrity under concurrent 802.15.4 traffic with security enabled.

A fix is available that adds calls to skb_cow_data() before performing in-place cryptographic operations on skb data, ensuring the data buffer is not shared and safe to modify. Users should apply the official Linux kernel patches that address this issue. Since this is a kernel vulnerability, updating to a fixed kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the Linux kernel vendor advisory for the latest remediation guidance.