CVE-2026-89487

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: only skb_tx_error() a packet we are about to drop

queue_userspace_packet() borrows the packet skb -- it only copies it into

a private netlink message (user_skb) and does not own it; on return

do_execute_actions() keeps forwarding it through the flow's remaining

actions. Its error path nevertheless calls skb_tx_error(skb), which via

skb_zcopy_clear() does skb_shinfo(skb)->flags &= ~SKBFL_ALL_ZEROCOPY,

stripping SKBFL_SHARED_FRAG from that live skb (skb_tx_error()'s kerneldoc

says "skb must be freed afterwards").

For a MSG_ZEROCOPY skb carrying page-cache frags, SKBFL_SHARED_FRAG is

what makes esp_input() skb_cow_data() before in-place AEAD; once it is

stripped a later local ESP-in-UDP delivery decrypts in place over pages

the sender does not own -- an unprivileged page-cache write (the

"Fragnesia" primitive).

do_execute_actions() ignores output_userspace()'s return value, so any

action after a failed USE

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References