{"id":"CVE-2026-80977","title":"net: skbuff: don't touch shared zerocopy state in skb_tx_error()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don't touch shared zerocopy state in skb_tx_error()\n\nskb_tx_error() completes the zerocopy uarg and clears\nSKBFL_ALL_ZEROCOPY, and skb_zcopy_downgrade_mana…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-821"],"vendor":"Linux","product":"Linux","affected":["Linux >= 25121173f7b1e4ac3fc692df6e7b8c52ec36abba < 6493165034bca14033bf49c9cec7b45e97a91497","Linux >= 25121173f7b1e4ac3fc692df6e7b8c52ec36abba < b4452349dcf4d561e13be768d5d278de58248930","Linux >= 25121173f7b1e4ac3fc692df6e7b8c52ec36abba < 363c4252ffc473a0203e91b83ede5519dfb8bd07","Linux >= 25121173f7b1e4ac3fc692df6e7b8c52ec36abba < 6ec22afc82a3cae07ade0a6ec361ae2532128ff5","Linux >= 25121173f7b1e4ac3fc692df6e7b8c52ec36abba < 15aa81b390d401abf4b8211042470e9e92e3b7fb","Linux >= 25121173f7b1e4ac3fc692df6e7b8c52ec36abba < 288f9970670841044ab030104fa6b6ed159949d0","Linux >= 25121173f7b1e4ac3fc692df6e7b8c52ec36abba < 0370da114a9bc044e248b85c6809d1b5e0c1f7f9","Linux >= 25121173f7b1e4ac3fc692df6e7b8c52ec36abba < f66bdb1cc0fcd227a062378f8be0b5873aa5600a","Linux 3.8"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T19:21:39.834701Z"},"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:46:01.788Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80977","references":[{"url":"https://git.kernel.org/stable/c/6493165034bca14033bf49c9cec7b45e97a91497"},{"url":"https://git.kernel.org/stable/c/b4452349dcf4d561e13be768d5d278de58248930"},{"url":"https://git.kernel.org/stable/c/363c4252ffc473a0203e91b83ede5519dfb8bd07"},{"url":"https://git.kernel.org/stable/c/6ec22afc82a3cae07ade0a6ec361ae2532128ff5"},{"url":"https://git.kernel.org/stable/c/15aa81b390d401abf4b8211042470e9e92e3b7fb"},{"url":"https://git.kernel.org/stable/c/288f9970670841044ab030104fa6b6ed159949d0"},{"url":"https://git.kernel.org/stable/c/0370da114a9bc044e248b85c6809d1b5e0c1f7f9"},{"url":"https://git.kernel.org/stable/c/f66bdb1cc0fcd227a062378f8be0b5873aa5600a"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80977.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-80977"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532197"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80977"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80977"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80977.mbox"}],"tags":["cve.org","csaf","vex","red-hat"],"epss":0.00129,"epssPercentile":0.02536,"scores":{"cna":7.8,"vendor":7},"ingestedAt":"2026-09-14T15:23:07.455Z","slug":"CVE-2026-80977","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don't touch shared zerocopy state in skb_tx_error()\n\nskb_tx_error() completes the zerocopy uarg and clears\nSKBFL_ALL_ZEROCOPY, and skb_zcopy_downgrade_managed() clears\nSKBFL_MANAGED_FRAG_REFS. Both live in skb_shinfo(), which every clone\nshares, while the caller only owns the reference it is about to drop.\nThrough a clone it tells the producer its pages are free and drops\nSKBFL_SHARED_FRAG for an skb that is still in flight.\n\nOpen vSwitch reaches this with a non-last OVS_ACTION_ATTR_RECIRC:\nclone_execute() sends a skb_clone() into ovs_dp_process_packet() while\ndo_execute_actions() keeps forwarding the original, and skb_clone()\ndoes not privatise the frags here -- skb_orphan_frags() returns early\non SKBFL_DONT_ORPHAN. A flow miss on the clone then strips the marker\nfrom the packet still being forwarded, and a later local ESP delivery\ndecrypts in place over frags it does not own privately.\n\nSkip it for a cloned skb. Nothing is lost: skb_release_data() clears\nthe zerocopy state once the last reference to the shared data goes.\n\n## Affected\n\n- `Linux >= 25121173f7b1e4ac3fc692df6e7b8c52ec36abba < 6493165034bca14033bf49c9cec7b45e97a91497`\n- `Linux >= 25121173f7b1e4ac3fc692df6e7b8c52ec36abba < b4452349dcf4d561e13be768d5d278de58248930`\n- `Linux >= 25121173f7b1e4ac3fc692df6e7b8c52ec36abba < 363c4252ffc473a0203e91b83ede5519dfb8bd07`\n- `Linux >= 25121173f7b1e4ac3fc692df6e7b8c52ec36abba < 6ec22afc82a3cae07ade0a6ec361ae2532128ff5`\n- `Linux >= 25121173f7b1e4ac3fc692df6e7b8c52ec36abba < 15aa81b390d401abf4b8211042470e9e92e3b7fb`\n- `Linux >= 25121173f7b1e4ac3fc692df6e7b8c52ec36abba < 288f9970670841044ab030104fa6b6ed159949d0`\n- `Linux >= 25121173f7b1e4ac3fc692df6e7b8c52ec36abba < 0370da114a9bc044e248b85c6809d1b5e0c1f7f9`\n- `Linux >= 25121173f7b1e4ac3fc692df6e7b8c52ec36abba < f66bdb1cc0fcd227a062378f8be0b5873aa5600a`\n- `Linux 3.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80977.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":223333,"id":"CVE-2026-80977","ts":1792180061078,"field":"cvss","old":"7","new":"7.8"},{"seq":204183,"id":"CVE-2026-80977","ts":1789490237463,"field":"cvss","old":"7.8","new":"7"},{"seq":183814,"id":"CVE-2026-80977","ts":1789356677508,"field":"cvss","old":"7.8","new":"7.4"},{"seq":153158,"id":"CVE-2026-80977","ts":1789285349340,"field":"cvss","old":null,"new":"7.8"},{"seq":153157,"id":"CVE-2026-80977","ts":1789285349340,"field":"severity","old":"none","new":"high"},{"seq":147608,"id":"CVE-2026-80977","ts":1789270211578,"field":"cvss","old":null,"new":"7.4"},{"seq":147607,"id":"CVE-2026-80977","ts":1789270211578,"field":"severity","old":"none","new":"high"},{"seq":109354,"id":"CVE-2026-80977","ts":1789183731582,"field":"cvss","old":null,"new":"7.4"},{"seq":109353,"id":"CVE-2026-80977","ts":1789183731582,"field":"severity","old":"none","new":"high"}]}