{"id":"CVE-2026-89487","summary":"openvswitch: only skb_tx_error() a packet we are about to drop","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: only skb_tx_error() a packet we are about to drop\n\nqueue_userspace_packet() borrows the packet skb -- it only copies it into\na private netlink message (user_skb) and does not own it; on return\ndo_execute_actions() keeps forwarding it through the flow's remaining\nactions. Its error path nevertheless calls skb_tx_error(skb), which via\nskb_zcopy_clear() does skb_shinfo(skb)-\u003eflags &= ~SKBFL_ALL_ZEROCOPY,\nstripping SKBFL_SHARED_FRAG from that live skb (skb_tx_error()'s kerneldoc\nsays \"skb must be freed afterwards\").\n\nFor a MSG_ZEROCOPY skb carrying page-cache frags, SKBFL_SHARED_FRAG is\nwhat makes esp_input() skb_cow_data() before in-place AEAD; once it is\nstripped a later local ESP-in-UDP delivery decrypts in place over pages\nthe sender does not own -- an unprivileged page-cache write (the\n\"Fragnesia\" primitive).\ndo_execute_actions() ignores output_userspace()'s return value, so any\naction after a failed USERSPACE upcall inherits the stripped skb.\n\nMove the skb_tx_error() to the flow-miss drop path - the \"default\"\nbranch of ovs_dp_process_packet()'s switch(error), before kfree_skb().\n\nThe call has been here since commit 36d5fe6a0007 (\"core, nfqueue,\nopenvswitch: Orphan frags in skb_zerocopy and handle errors\") but was\nharmless until esp_input() began relying on SKBFL_SHARED_FRAG to gate\nin-place decrypt; only then did stripping it on a still-forwarded skb\nbecome a page-cache write primitive.","modified":"2026-11-13T04:02:44.293688850Z","published":"2026-09-11T19:43:40.776Z","related":["SUSE-SU-2026:24643-1","SUSE-SU-2026:24648-1","SUSE-SU-2026:24651-1","SUSE-SU-2026:24662-1","openSUSE-SU-2026:11880-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89487.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0dbc2398fca3bb33eda963849f865ddb1b3aa05e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4477222e2916a18e273edc139c955ade6bbb7a69"},{"type":"WEB","url":"https://git.kernel.org/stable/c/48db11e115d1b232edc5591604adc6eda95cd545"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4d5c460ef8754be1d43b16dbf02695b008b207d6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5d85eef222cfd28e73deed7402c100229e8b9e6e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5de5d554141a15b3f1f5c978fd9f7f4fd6d0600a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6767d70cf46f65807a6a4c4406a518e6c12e36ae"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e41a59fc056f63a7a1f42788913c53cc48d744aa"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89487.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89487"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"36d5fe6a000790f56039afe26834265db0a3ad4c"},{"fixed":"5de5d554141a15b3f1f5c978fd9f7f4fd6d0600a"},{"fixed":"48db11e115d1b232edc5591604adc6eda95cd545"},{"fixed":"4477222e2916a18e273edc139c955ade6bbb7a69"},{"fixed":"4d5c460ef8754be1d43b16dbf02695b008b207d6"},{"fixed":"6767d70cf46f65807a6a4c4406a518e6c12e36ae"},{"fixed":"e41a59fc056f63a7a1f42788913c53cc48d744aa"},{"fixed":"5d85eef222cfd28e73deed7402c100229e8b9e6e"},{"fixed":"0dbc2398fca3bb33eda963849f865ddb1b3aa05e"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"c5f0c0e7525443add533495e93ba8de6feab2396"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"1674b4bf3eea3cac51b70778e89f8025f7cfe695"}]}],"versions":["v3.10.108","v3.10.107","v3.10.106","v3.10.105","v3.10.104","v3.10.103","v3.10.102","v3.10.101","v3.10.100","v3.10.99","v3.10.98","v3.10.97","v3.10.96","v3.10.95","v3.10.94","v3.10.93","v3.10.92","v3.10.91","v3.10.90","v3.10.89","v3.10.88","v3.10.87","v3.10.86","v3.10.85","v3.10.84","v3.10.83","v3.10.82","v3.10.81","v3.10.80","v3.10.79","v3.10.78","v3.10.77","v3.10.76","v3.10.75","v3.10.74","v3.10.73","v3.10.72","v3.10.71","v3.10.70","v3.10.69","v3.10.68","v3.10.67","v3.10.66","v3.10.65","v3.10.64","v3.10.63","v3.10.62","v3.10.61","v3.10.60","v3.10.59","v3.10.58","v3.10.57","v3.10.56","v3.10.55","v3.10.54","v3.10.53","v3.10.52","v3.10.51","v3.12.74","v3.12.73","v3.12.72","v3.12.71","v3.12.70","v3.12.69","v3.12.68","v3.12.67","v3.12.66","v3.12.65","v3.12.64","v3.12.63","v3.12.62","v3.12.61","v3.12.60","v3.12.59","v3.12.58","v3.12.57","v3.12.56","v3.12.55","v3.12.54","v3.12.53","v3.12.52","v3.12.51","v3.12.50","v3.12.49","v3.12.48","v3.12.47","v3.12.46","v3.12.45","v3.12.44","v3.12.43","v3.12.42","v3.12.41","v3.12.40"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-89487.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.10.51"},{"fixed":"3.11"}]},{"type":"ECOSYSTEM","events":[{"introduced":"3.12.40"},{"fixed":"3.13"}]},{"type":"ECOSYSTEM","events":[{"introduced":"3.14.0"},{"fixed":"5.10.270"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.221"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.188"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.157"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.109"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.50"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-89487.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}