CVE-2026-89487

Received Received - Intake

Linux kernel skb_tx_error misuse leads to ESP-in-UDP page-cache write

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skb_tx_error() a packet we are about to drop queue_userspace_packet() borrows the packet skb -- it only copies it into a private netlink message (user_skb) and does not own it; on return do_execute_actions() keeps forwarding it through the flow's remaining actions. Its error path nevertheless calls skb_tx_error(skb), which via skb_zcopy_clear() does skb_shinfo(skb)->flags &= ~SKBFL_ALL_ZEROCOPY, stripping SKBFL_SHARED_FRAG from that live skb (skb_tx_error()'s kerneldoc says "skb must be freed afterwards"). For a MSG_ZEROCOPY skb carrying page-cache frags, SKBFL_SHARED_FRAG is what makes esp_input() skb_cow_data() before in-place AEAD; once it is stripped a later local ESP-in-UDP delivery decrypts in place over pages the sender does not own -- an unprivileged page-cache write (the "Fragnesia" primitive). do_execute_actions() ignores output_userspace()'s return value, so any action after a failed USERSPACE upcall inherits the stripped skb. Move the skb_tx_error() to the flow-miss drop path - the "default" branch of ovs_dp_process_packet()'s switch(error), before kfree_skb(). The call has been here since commit 36d5fe6a0007 ("core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors") but was harmless until esp_input() began relying on SKBFL_SHARED_FRAG to gate in-place decrypt; only then did stripping it on a still-forwarded skb become a page-cache write primitive.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89487

EUVD

EUVD-2026-76393

Affected Vendors & Products

Vendor	Product	Version / Range
openvswitch	openvswitch	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a misuse of skb_tx_error() in Open vSwitch. When a packet is forwarded through flow actions, an error path incorrectly calls skb_tx_error() on a borrowed skb, stripping a critical flag (SKBFL_SHARED_FRAG) that protects against in-place decryption of ESP-in-UDP packets. This can lead to a page-cache write primitive called 'Fragnesia'.

Detection Guidance

This vulnerability affects the Linux kernel's Open vSwitch (OVS) implementation. Detection requires checking for vulnerable kernel versions and OVS configurations. Monitor kernel logs for skb_tx_error() related errors or crashes in OVS components. Check if your system uses OVS with MSG_ZEROCOPY enabled and ESP-in-UDP decryption. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to write to arbitrary pages in the page cache, potentially gaining unauthorized access or modifying sensitive data. Systems using Open vSwitch with ESP-in-UDP decryption are at risk if they process packets with MSG_ZEROCOPY.

Mitigation Strategies

Apply the kernel patch resolving this issue. Update Open vSwitch to a patched version. Disable MSG_ZEROCOPY if not required. Avoid using ESP-in-UDP decryption until patched. Monitor for signs of exploitation like unexpected page-cache writes or crashes in OVS.

Hi! I’m here to help you understand CVE-2026-89487. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70