CVE-2026-89487

Status: UPDATED  |  Advisory ID: CVE-2026-89487

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: only skb_tx_error() a packet we are about to drop

queue_userspace_packet() borrows the packet skb -- it only copies it into

a private netlink message (user_skb) and does not own it; on return

do_execute_actions() keeps forwarding it through the flow's remaining

actions. Its error path nevertheless calls skb_tx_error(skb), which via

skb_zcopy_clear() does skb_shinfo(skb)->flags &= ~SKBFL_ALL_ZEROCOPY,

stripping SKBFL_SHARED_FRAG from that live skb (skb_tx_error()'s kerneldoc

says "skb must be freed afterwards").

For a MSG_ZEROCOPY skb carrying page-cache frags, SKBFL_SHARED_FRAG is

what makes esp_input() skb_cow_data() before in-place AEAD; once it is

stripped a later local ESP-in-UDP delivery decrypts in place over pages

the sender does not own -- an unprivileged page-cache write (the

"Fragnesia" primitive).

do_execute_actions() ignores output_userspace()'s return value, so any

action after a failed USERSPACE upcall inherits the stripped skb.

Move the skb_tx_error() to the flow-miss drop path - the "default"

branch of ovs_dp_process_packet()'s switch(error), before kfree_skb().

The call has been here since commit 36d5fe6a0007 ("core, nfqueue,

openvswitch: Orphan frags in skb_zerocopy and handle errors") but was

harmless until esp_input() began relying on SKBFL_SHARED_FRAG to gate

in-place decrypt; only then did stripping it on a still-forwarded skb

become a page-cache write primitive. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References