A vulnerability in the Linux kernel's skb_zerocopy() function causes improper propagation of the shared-frag marker. This leads to incorrect assumptions about shared fragments in socket buffers, allowing certain in-place decryption operations to overwrite page cache memory. An unprivileged user can exploit this to write into the page cache of root-owned read-only files.