The vulnerability in the Linux kernel's openvswitch relates to the incorrect invocation of skb_tx_error() on packets that are still forwarded through the flow's remaining actions. The function skb_tx_error() clears the SKBFL_SHARED_FRAG flag on the skb, which is critical for the esp_input() function to correctly perform copy-on-write before in-place AEAD decryption. Stripping this flag prematurely allows a later local ESP-in-UDP delivery to decrypt in place over page-cache fragments that the sender does not own, effectively enabling an unprivileged page-cache write primitive known as "Fragnesia." The fix involves moving the skb_tx_error() call to the flow-miss drop path, ensuring it is only called on packets that are actually dropped, thus preserving the SKBFL_SHARED_FRAG flag on live packets.

This vulnerability enables an unprivileged local attacker to perform unauthorized writes to the page cache by exploiting the premature clearing of the SKBFL_SHARED_FRAG flag on packets that are still forwarded. This can lead to potential data corruption or escalation of privileges through manipulation of page-cache memory. The issue affects the Linux kernel's openvswitch networking component and specifically impacts the handling of ESP-in-UDP packets.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves moving the skb_tx_error() call to the correct drop path in the code. Until an official patch is available, users should monitor vendor advisories for updates. No other mitigation steps are specified in the provided data.