CVE-2026-80977

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-80977

Key Details

CVE	CVE-2026-80977
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: don't touch shared zerocopy state in skb_tx_error()

skb_tx_error() completes the zerocopy uarg and clears

SKBFL_ALL_ZEROCOPY, and skb_zcopy_downgrade_managed() clears

SKBFL_MANAGED_FRAG_REFS. Both live in skb_shinfo(), which every clone

shares, while the caller only owns the reference it is about to drop.

Through a clone it tells the producer its pages are free and drops

SKBFL_SHARED_FRAG for an skb that is still in flight.

Open vSwitch reaches this with a non-last OVS_ACTION_ATTR_RECIRC:

clone_execute() sends a skb_clone() into ovs_dp_process_packet() while

do_execute_actions() keeps forwarding the original, and skb_clone()

does not privatise the frags here -- skb_orphan_frags() returns early

on SKBFL_DONT_ORPHAN. A flow miss on the clone then strips the marker

from the packet still being forwarded, and a later local ESP delivery

decrypts in place over frags it does not own privately.

Skip it for a cloned skb. Nothing is lost: skb_release_data() clears

the zerocopy state once the last reference to the shared data goes. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-80977
CVE	https://www.cve.org/CVERecord?id=CVE-2026-80977

Source

Reference

NVD

CVE