EUVD-2026-76393
GHSA-7xvh-m494-6w6x
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H reflects the simultaneous requirement for OVS USERSPACE flows, MSG_ZEROCOPY sockets, and local ESP-in-UDP delivery; all other metrics match the provided vector.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
openvswitch: only skb_tx_error() a packet we are about to drop
queue_userspace_packet() borrows the packet skb -- it only copies it into a private netlink message (user_skb) and does not own it; on return do_execute_actions() keeps forwarding it through the flow's remaining actions. Its error path nevertheless calls skb_tx_error(skb), which via skb_zcopy_clear() does skb_shinfo(skb)->flags &= ~SKBFL_ALL_ZEROCOPY, stripping SKBFL_SHARED_FRAG from that live skb (skb_tx_error()'s kerneldoc says "skb must be freed afterwards").
For a MSG_ZEROCOPY skb carrying page-cache frags, SKBFL_SHARED_FRAG is what makes esp_input() skb_cow_data() before in-place AEAD; once it is stripped a later local ESP-in-UDP delivery decrypts in place over pages the sender does not own -- an unprivileged page-cache write (the "Fragnesia" primitive). do_execute_actions() ignores output_userspace()'s return value, so any action after a failed USERSPACE upcall inherits the stripped skb.
Move the skb_tx_error() to the flow-miss drop path - the "default" branch of ovs_dp_process_packet()'s switch(error), before kfree_skb().
The call has been here since commit 36d5fe6a0007 ("core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors") but was harmless until esp_input() began relying on SKBFL_SHARED_FRAG to gate in-place decrypt; only then did stripping it on a still-forwarded skb become a page-cache write primitive.
AnalysisAI
OpenVSwitch packet forwarding in the Linux kernel exposes a page-cache write primitive ("Fragnesia") when MSG_ZEROCOPY packets are processed through the userspace upcall error path. When queue_userspace_packet() fails and calls skb_tx_error() on a still-live, still-forwarded skb, it strips SKBFL_SHARED_FRAG via skb_zcopy_clear(). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following conditions to be met simultaneously: (1) An OpenVSwitch datapath must be active and configured with at least one flow that includes a USERSPACE action triggering `queue_userspace_packet()`. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly reflects local privilege-requiring exploitation and all three impact dimensions, but AC:L appears optimistic given the multi-condition attack path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available: upgrade to Linux kernel 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running OpenVSwitch with Linux kernel versions below 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 and flag those handling sensitive network traffic. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today