Executive brief
OpenVswitch is a virtual network switching component used in Linux kernel-based systems to manage data center networking. A flaw in its packet handling allows an unprivileged local attacker to write to memory pages they do not own by manipulating encryption-related flags on packets, potentially leading to data corruption or privilege escalation on affected systems.
Technical details
The vulnerability exists in OpenVswitch's queue_userspace_packet() function, which improperly calls skb_tx_error() on a borrowed packet buffer that is still being forwarded through the kernel's network stack. The skb_tx_error() function strips the SKBFL_SHARED_FRAG flag from the skb_shinfo structure via skb_zcopy_clear(), which is meant to only be called when the packet is about to be freed. When ESP (Encapsulating Security Payload) input processing later relies on this flag to determine whether to perform copy-on-write before in-place decryption, the flag's removal allows decryption to occur in-place over page-cache pages that the sender does not own (the "Fragnesia" primitive). This is a use-after-flag-strip condition, requiring MSG_ZEROCOPY skbs carrying page-cache fragments. The fix moves skb_tx_error() to the actual packet drop path in ovs_dp_process_packet(). Patch is available and has been backported to stable kernel branches.
Affected products
- Linux Linux kernel multiple versions (see kernel stable tree branches)
Timeline
- 2026-09-11: disclosed: CVE-2026-89487 published
- 2026-08-25: patched: Upstream patch 0dbc2398fca3bb33eda963849f865ddb1b3aa05e committed
- 2026-09-14: other: Backported to stable kernel trees