The skb that wasn't freed - the Fragnesia primitive via Open vSwitch
Doyensec details CVE-2026-90049 in Open vSwitch, enabling deterministic Linux kernel local privilege escalation on default major distribution installs.
Doyensec reports that the Open vSwitch datapath strips the SKBFL_SHARED_FRAG flag from packets it is still forwarding, allowing an in-place decrypt to write attacker-chosen bytes into root-owned page cache — a Dirty COW-class primitive that re-opens the Fragnesia bug family. The issues are tracked as CVE-2026-90049, CVE-2026-89487, and CVE-2026-80977, and were reported to the kernel security team with fixes coordinated alongside OVS maintainers. A deterministic local privilege escalation works on default installs of Arch, Fedora, Debian, Amazon Linux, and RHEL where unprivileged user namespaces and openvswitch auto-loading are enabled; the fix landed in mainline and shipped in stable on 09/04/2026. The write technique builds on the earlier Fragnesia and Dirty Frag bugs, including CVE-2026-43284 and CVE-2026-43500.
- Open vSwitch strips SKBFL_SHARED_FRAG from forwarded packets, restoring the Fragnesia write primitive.
- Deterministic LPE affects default Arch, Fedora, Debian, Amazon Linux, and RHEL with user namespaces.
- Fix coordinated with kernel security team and OVS maintainers; shipped in stable on 09/04/2026.
- Builds on the Dirty Frag family including CVE-2026-43284 and CVE-2026-43500.
- Vendors
- DoyensecLinux Foundation
- Products
- Open vSwitchLinux kernel
- Organizations
- Kernel security team
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-43284 | Linux kernel ESP-in-UDP decrypts in place over shared splice pages (CWE-123) | 8.8 | 94% | PoC | |
| CVE-2026-43500 | Out-of-bounds write in Linux kernel AF_RXRPC decryption enables root access | 7.8 | 93% | ||
CVE-2026-80977+1 related CVE | Shared zerocopy state corruption in Linux kernel via Open vSwitch recirculation clones | 7.8 | — | ||
| CVE-2026-90049 | Linux kernel skb_zerocopy() error-path flaw risks UAF/memory corruption via Open vSwitch | 9.3 | — |
From the original article
15 min read at blog.doyensec.comThe skb that wasn't freed - the Fragnesia primitive via Open vSwitch TLDR: Exploit . This is a deterministic local privilege escalation affecting the default install of the latest Arch, Fedora, Debian, Amazon Linux and RHEL distributions, having unprivileged user namespaces enabled, openvswitch auto-loading, and a stock kernel carrying the Fragnesia fix.
By blog.doyensec.com via buherator · blog.doyensec.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.