---
id: CVE-2026-89487
title: 'openvswitch: only skb_tx_error() a packet we are about to drop'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  openvswitch: only skb_tx_error() a packet we are about to drop

  queue_userspace_packet() borrows the packet skb -- it only copies it into
  a private netlink message (use…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-367
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 36d5fe6a000790f56039afe26834265db0a3ad4c <
    5de5d554141a15b3f1f5c978fd9f7f4fd6d0600a
  - >-
    Linux >= 36d5fe6a000790f56039afe26834265db0a3ad4c <
    48db11e115d1b232edc5591604adc6eda95cd545
  - >-
    Linux >= 36d5fe6a000790f56039afe26834265db0a3ad4c <
    4477222e2916a18e273edc139c955ade6bbb7a69
  - >-
    Linux >= 36d5fe6a000790f56039afe26834265db0a3ad4c <
    4d5c460ef8754be1d43b16dbf02695b008b207d6
  - >-
    Linux >= 36d5fe6a000790f56039afe26834265db0a3ad4c <
    6767d70cf46f65807a6a4c4406a518e6c12e36ae
  - >-
    Linux >= 36d5fe6a000790f56039afe26834265db0a3ad4c <
    e41a59fc056f63a7a1f42788913c53cc48d744aa
  - >-
    Linux >= 36d5fe6a000790f56039afe26834265db0a3ad4c <
    5d85eef222cfd28e73deed7402c100229e8b9e6e
  - >-
    Linux >= 36d5fe6a000790f56039afe26834265db0a3ad4c <
    0dbc2398fca3bb33eda963849f865ddb1b3aa05e
  - Linux c5f0c0e7525443add533495e93ba8de6feab2396
  - Linux 1674b4bf3eea3cac51b70778e89f8025f7cfe695
  - Linux >= 3.10.51 < 3.11
  - Linux >= 3.12.40 < 3.13
  - Linux 3.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T19:22:44.373891Z'
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:47:37.837Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89487'
references:
  - url: 'https://git.kernel.org/stable/c/5de5d554141a15b3f1f5c978fd9f7f4fd6d0600a'
  - url: 'https://git.kernel.org/stable/c/48db11e115d1b232edc5591604adc6eda95cd545'
  - url: 'https://git.kernel.org/stable/c/4477222e2916a18e273edc139c955ade6bbb7a69'
  - url: 'https://git.kernel.org/stable/c/4d5c460ef8754be1d43b16dbf02695b008b207d6'
  - url: 'https://git.kernel.org/stable/c/6767d70cf46f65807a6a4c4406a518e6c12e36ae'
  - url: 'https://git.kernel.org/stable/c/e41a59fc056f63a7a1f42788913c53cc48d744aa'
  - url: 'https://git.kernel.org/stable/c/5d85eef222cfd28e73deed7402c100229e8b9e6e'
  - url: 'https://git.kernel.org/stable/c/0dbc2398fca3bb33eda963849f865ddb1b3aa05e'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89487.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89487'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532517'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89487'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89487'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89487.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00129
epssPercentile: 0.02548
scores:
  cna: 7.8
  vendor: 7
ingestedAt: '2026-09-14T15:23:07.452Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: only skb_tx_error() a packet we are about to drop

queue_userspace_packet() borrows the packet skb -- it only copies it into
a private netlink message (user_skb) and does not own it; on return
do_execute_actions() keeps forwarding it through the flow's remaining
actions. Its error path nevertheless calls skb_tx_error(skb), which via
skb_zcopy_clear() does skb_shinfo(skb)->flags &= ~SKBFL_ALL_ZEROCOPY,
stripping SKBFL_SHARED_FRAG from that live skb (skb_tx_error()'s kerneldoc
says "skb must be freed afterwards").

For a MSG_ZEROCOPY skb carrying page-cache frags, SKBFL_SHARED_FRAG is
what makes esp_input() skb_cow_data() before in-place AEAD; once it is
stripped a later local ESP-in-UDP delivery decrypts in place over pages
the sender does not own -- an unprivileged page-cache write (the
"Fragnesia" primitive).
do_execute_actions() ignores output_userspace()'s return value, so any
action after a failed USERSPACE upcall inherits the stripped skb.

Move the skb_tx_error() to the flow-miss drop path - the "default"
branch of ovs_dp_process_packet()'s switch(error), before kfree_skb().

The call has been here since commit 36d5fe6a0007 ("core, nfqueue,
openvswitch: Orphan frags in skb_zerocopy and handle errors") but was
harmless until esp_input() began relying on SKBFL_SHARED_FRAG to gate
in-place decrypt; only then did stripping it on a still-forwarded skb
become a page-cache write primitive.

## Affected

- `Linux >= 36d5fe6a000790f56039afe26834265db0a3ad4c < 5de5d554141a15b3f1f5c978fd9f7f4fd6d0600a`
- `Linux >= 36d5fe6a000790f56039afe26834265db0a3ad4c < 48db11e115d1b232edc5591604adc6eda95cd545`
- `Linux >= 36d5fe6a000790f56039afe26834265db0a3ad4c < 4477222e2916a18e273edc139c955ade6bbb7a69`
- `Linux >= 36d5fe6a000790f56039afe26834265db0a3ad4c < 4d5c460ef8754be1d43b16dbf02695b008b207d6`
- `Linux >= 36d5fe6a000790f56039afe26834265db0a3ad4c < 6767d70cf46f65807a6a4c4406a518e6c12e36ae`
- `Linux >= 36d5fe6a000790f56039afe26834265db0a3ad4c < e41a59fc056f63a7a1f42788913c53cc48d744aa`
- `Linux >= 36d5fe6a000790f56039afe26834265db0a3ad4c < 5d85eef222cfd28e73deed7402c100229e8b9e6e`
- `Linux >= 36d5fe6a000790f56039afe26834265db0a3ad4c < 0dbc2398fca3bb33eda963849f865ddb1b3aa05e`
- `Linux c5f0c0e7525443add533495e93ba8de6feab2396`
- `Linux 1674b4bf3eea3cac51b70778e89f8025f7cfe695`
- `Linux >= 3.10.51 < 3.11`
- `Linux >= 3.12.40 < 3.13`
- `Linux 3.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Red Hat Enterprise Linux 6 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89487.json)