CVE-2026-89487

The Linux kernel's Open vSwitch module mishandles failures of the USERSPACE action: queue_userspace_packet()'s error path calls skb_tx_error() on an skb it has only borrowed (not dropped), stripping the SKBFL_SHARED_FRAG zerocopy flag from a packet that do_execute_actions() keeps forwarding through the rest of the flow's actions. On a MSG_ZEROCOPY packet carrying page-cache fragments, that flag is what forces the ESP input path (esp_input()) to copy the data before decrypting in place; once stripped, a locally delivered ESP-in-UDP packet decrypts in place over shared page-cache pages the sender does not own, giving an unprivileged local user a page-cache write primitive (the 'Fragnesia' technique). Successful exploitation gives an attacker high confidentiality, integrity, and availability impact — for example, tampering with page-cache-backed file contents to escalate privileges (CVSS 3.1: 7.8, local attack vector, low privileges required). Affected products are Linux kernels containing the openvswitch module, with the flawed error path present since commit 36d5fe6a0007 (2018) but only becoming exploitable once esp_input() began relying on SKBFL_SHARED_FRAG to gate in-place decryption. No public proof-of-concept is known and the flaw is not on CISA's KEV; exploitation requires local code execution plus specific OVS, zerocopy, and ESP-in-UDP conditions.

What to do: Patch to a kernel containing the fix (the skb_tx_error() call relocated to the flow-miss drop path in ovs_dp_process_packet()) as soon as your distribution ships it, prioritizing OVS/OVN hosts — OpenStack compute nodes, OpenShift/OVN-Kubernetes nodes, hypervisors — and any host with local unprivileged users or containers. Until patched, audit OVS flows for USERSPACE actions (e.g., sFlow/NetFlow sampling or other upcalls) on machines that also deliver ESP-in-UDP locally, and treat local unprivileged tenants on those hosts as elevated risk. Hosts not running the openvswitch module are not exposed via this path.