CVE-2026-89487openvswitch: only skb_tx_error() a packet we are about to drop
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skb_tx_error() a packet we are about to drop queue_userspace_packet() borrows the packet skb -- it only copies it into a private netlink message (user_skb) and does not own it; on return do_execute_actions() keeps forwarding it through the flow's remaining actions. Its error path nevertheless calls skb_tx_error(skb), which via skb_zcopy_clear() does skb_shinfo(skb)->flags &= ~SKBFL_ALL_ZEROCOPY, stripping SKBFL_SHARED_FRAG from that live skb (skb_tx_error()'s kerneldoc says "skb must be freed afterwards"). For a MSG_ZEROCOPY skb carrying page-cache frags, SKBFL_SHARED_FRAG is what makes esp_input() skb_cow_data() before in-place AEAD; once it is stripped a later local ESP-in-UDP delivery decrypts in place over pages the sender does not own -- an unprivileged page-cache write (the "Fragnesia" primitive). do_execute_actions() ignores output_userspace()'s return value, so any action after a failed USERSPACE upcall inherits the stripped skb. Move the skb_tx_error() to the flow-miss drop path - the "default" branch of ovs_dp_process_packet()'s switch(error), before kfree_skb(). The call has been here since commit 36d5fe6a0007 ("core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors") but was harmless until esp_input() began relying on SKBFL_SHARED_FRAG to gate in-place decrypt; only then did stripping it on a still-forwarded skb become a page-cache write primitive.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 36d5fe6a000790f56039afe26834265db0a3ad4c builds before 5de5d554141a15b3f1f5c978fd9f7f4fd6d0600a; from 36d5fe6a000790f56039afe26834265db0a3ad4c before 48db11e115d1b232edc5591604adc6eda95cd545; from 36d5fe6a000790f56039afe26834265db0a3ad4c before 4477222e2916a18e273edc139c955ade6bbb7a69; 36d5fe6a000790f56039afe26834265db0a3ad4c builds before 4d5c460ef8754be1d43b16dbf02695b008b207d6; from 36d5fe6a000790f56039afe26834265db0a3ad4c before 6767d70cf46f65807a6a4c4406a518e6c12e36ae; from 36d5fe6a000790f56039afe26834265db0a3ad4c before e41a59fc056f63a7a1f42788913c53cc48d744aa; 36d5fe6a000790f56039afe26834265db0a3ad4c builds before 5d85eef222cfd28e73deed7402c100229e8b9e6e; 36d5fe6a000790f56039afe26834265db0a3ad4c builds before 0dbc2398fca3bb33eda963849f865ddb1b3aa05e; and 4 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/5de5d554141a15b3f1f5c978fd9f7f4fd6d0600a
- https://git.kernel.org/stable/c/48db11e115d1b232edc5591604adc6eda95cd545
- https://git.kernel.org/stable/c/4477222e2916a18e273edc139c955ade6bbb7a69
- https://git.kernel.org/stable/c/4d5c460ef8754be1d43b16dbf02695b008b207d6
- https://git.kernel.org/stable/c/6767d70cf46f65807a6a4c4406a518e6c12e36ae
- https://git.kernel.org/stable/c/e41a59fc056f63a7a1f42788913c53cc48d744aa
- https://git.kernel.org/stable/c/5d85eef222cfd28e73deed7402c100229e8b9e6e
- https://git.kernel.org/stable/c/0dbc2398fca3bb33eda963849f865ddb1b3aa05e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.