EUVD-2026-76300
GHSA-ppq5-hh8r-qqhh
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H because exploitation requires OVS RECIRC flow miss plus concurrent ESP delivery - a specific multi-condition state; AV:L and PR:L are accurate for local OVS access.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: don't touch shared zerocopy state in skb_tx_error()
skb_tx_error() completes the zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, and skb_zcopy_downgrade_managed() clears SKBFL_MANAGED_FRAG_REFS. Both live in skb_shinfo(), which every clone shares, while the caller only owns the reference it is about to drop. Through a clone it tells the producer its pages are free and drops SKBFL_SHARED_FRAG for an skb that is still in flight.
Open vSwitch reaches this with a non-last OVS_ACTION_ATTR_RECIRC: clone_execute() sends a skb_clone() into ovs_dp_process_packet() while do_execute_actions() keeps forwarding the original, and skb_clone() does not privatise the frags here -- skb_orphan_frags() returns early on SKBFL_DONT_ORPHAN. A flow miss on the clone then strips the marker from the packet still being forwarded, and a later local ESP delivery decrypts in place over frags it does not own privately.
Skip it for a cloned skb. Nothing is lost: skb_release_data() clears the zerocopy state once the last reference to the shared data goes.
AnalysisAI
Shared zerocopy state corruption in the Linux kernel networking stack allows a local low-privileged attacker - via Open vSwitch - to cause kernel memory corruption leading to privilege escalation. When skb_tx_error() is called on a cloned socket buffer (skb), it unconditionally clears shared zerocopy flags in skb_shinfo(), which all clones reference. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three specific conditions must all be satisfied simultaneously: (1) Open vSwitch must be active and a flow table entry must use a non-last OVS_ACTION_ATTR_RECIRC action - the clone_execute() path that creates a non-privatized skb_clone(); (2) the cloned packet must encounter a flow miss in the OVS datapath, triggering skb_tx_error() on the shared skb_shinfo() state; and (3) local ESP/IPsec delivery must be configured on the same packet path so that the now-marker-stripped original skb undergoes in-place decryption. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the local-only attack surface gated by low-privilege access, but the three-high impact metrics reflect the real severity of kernel memory corruption: an attacker who can trigger the ESP decrypt-over-unowned-frags path may read sensitive kernel memory (C:H), corrupt it (I:H), or cause a kernel panic (A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update to a patched Linux kernel: stable branch 6.12.x users should upgrade to 6.12.109 or later; 6.18.x users to 6.18.50 or later; 7.x users to 7.2.4 or later (or 7.3-rc1+ for development trees). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Open vSwitch and categorize by exposure (internet-facing vs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today