← Back to CVE Explorer

CVE-2026-89487

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skb_tx_error() a packet we are about to drop queue_userspace_packet() borrows the packet skb -- it only copies it into a private netlink message (user_skb) and does not own it; on return do_execute_actions() keeps forwarding it through the flow's remaining actions. Its error path nevertheless calls skb_tx_error(skb), which via skb_zcopy_clear() does skb_shinfo(skb)->flags &= ~SKBFL_ALL_ZEROCOPY, stripping SKBFL_SHARED_FRAG from that live skb (skb_tx_error()'s kerneldoc says "skb must be freed afterwards"). For a MSG_ZEROCOPY skb carrying page-cache frags, SKBFL_SHARED_FRAG is what makes esp_input() skb_cow_data() before in-place AEAD; once it is stripped a later local ESP-in-UDP delivery decrypts in place over pages the sender does not own -- an unprivileged page-cache write (the "Fragnesia" primitive). do_execute_actions() ignores output_userspace()'s return value, so any action after a failed USERSPACE upcall inherits the stripped skb. Move the skb_tx_error() to the flow-miss drop path - the "default" branch of ovs_dp_process_packet()'s switch(error), before kfree_skb(). The call has been here since commit 36d5fe6a0007 ("core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors") but was harmless until esp_input() began relying on SKBFL_SHARED_FRAG to gate in-place decrypt; only then did stripping it on a still-forwarded skb become a page-cache write primitive.

Severity
HIGH
CVSS score
7.8 (v3.1)
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-09-11 20:19:30.413000
Last modified
2026-10-19 09:17:42.307000
View original CVE JSON 
{
  "id": "CVE-2026-89487",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-11T20:19:30.413",
  "lastModified": "2026-10-19T09:17:42.307",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: only skb_tx_error() a packet we are about to drop\n\nqueue_userspace_packet() borrows the packet skb -- it only copies it into\na private netlink message (user_skb) and does not own it; on return\ndo_execute_actions() keeps forwarding it through the flow's remaining\nactions. Its error path nevertheless calls skb_tx_error(skb), which via\nskb_zcopy_clear() does skb_shinfo(skb)->flags &= ~SKBFL_ALL_ZEROCOPY,\nstripping SKBFL_SHARED_FRAG from that live skb (skb_tx_error()'s kerneldoc\nsays \"skb must be freed afterwards\").\n\nFor a MSG_ZEROCOPY skb carrying page-cache frags, SKBFL_SHARED_FRAG is\nwhat makes esp_input() skb_cow_data() before in-place AEAD; once it is\nstripped a later local ESP-in-UDP delivery decrypts in place over pages\nthe sender does not own -- an unprivileged page-cache write (the\n\"Fragnesia\" primitive).\ndo_execute_actions() ignores output_userspace()'s return value, so any\naction after a failed USERSPACE upcall inherits the stripped skb.\n\nMove the skb_tx_error() to the flow-miss drop path - the \"default\"\nbranch of ovs_dp_process_packet()'s switch(error), before kfree_skb().\n\nThe call has been here since commit 36d5fe6a0007 (\"core, nfqueue,\nopenvswitch: Orphan frags in skb_zerocopy and handle errors\") but was\nharmless until esp_input() began relying on SKBFL_SHARED_FRAG to gate\nin-place decrypt; only then did stripping it on a still-forwarded skb\nbecome a page-cache write primitive."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "net/openvswitch/datapath.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
              "lessThan": "5de5d554141a15b3f1f5c978fd9f7f4fd6d0600a",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
              "lessThan": "48db11e115d1b232edc5591604adc6eda95cd545",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
              "lessThan": "4477222e2916a18e273edc139c955ade6bbb7a69",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
              "lessThan": "4d5c460ef8754be1d43b16dbf02695b008b207d6",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
              "lessThan": "6767d70cf46f65807a6a4c4406a518e6c12e36ae",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
              "lessThan": "e41a59fc056f63a7a1f42788913c53cc48d744aa",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
              "lessThan": "5d85eef222cfd28e73deed7402c100229e8b9e6e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
              "lessThan": "0dbc2398fca3bb33eda963849f865ddb1b3aa05e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "c5f0c0e7525443add533495e93ba8de6feab2396",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "1674b4bf3eea3cac51b70778e89f8025f7cfe695",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "3.10.51",
              "lessThan": "3.11",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "3.12.40",
              "lessThan": "3.13",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "net/openvswitch/datapath.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "3.14",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "3.14",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.270",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.221",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.188",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.157",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.109",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.50",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.4",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-16T19:22:44.373891Z",
          "id": "CVE-2026-89487",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0dbc2398fca3bb33eda963849f865ddb1b3aa05e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4477222e2916a18e273edc139c955ade6bbb7a69",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/48db11e115d1b232edc5591604adc6eda95cd545",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4d5c460ef8754be1d43b16dbf02695b008b207d6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5d85eef222cfd28e73deed7402c100229e8b9e6e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5de5d554141a15b3f1f5c978fd9f7f4fd6d0600a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6767d70cf46f65807a6a4c4406a518e6c12e36ae",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e41a59fc056f63a7a1f42788913c53cc48d744aa",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}