CVE-2026-80977 Overview
CVE-2026-80977 is a Linux kernel flaw in the network skbuff layer. The function skb_tx_error() mutates shared zerocopy state (SKBFL_ALL_ZEROCOPY and SKBFL_MANAGED_FRAG_REFS) that lives in skb_shinfo() and is shared across every clone of a socket buffer. A caller that only owns one reference can prematurely signal page release to the producer and strip SKBFL_SHARED_FRAG from an skb still in flight. Open vSwitch (OVS) reaches this state through a non-last OVS_ACTION_ATTR_RECIRC action, where clone_execute() forwards a clone while the original continues processing. A subsequent local ESP delivery can then decrypt in place over fragments the sender no longer privately owns, corrupting memory the kernel is still using.
Critical Impact
A local, low-privileged user on a host running Open vSwitch with IPsec/ESP delivery can trigger in-place decryption over shared skb fragments, leading to memory corruption in the kernel network stack.
Affected Products
- Linux kernel networking subsystem (net/core/skbuff.c)
- Linux kernel Open vSwitch datapath (net/openvswitch) when OVS_ACTION_ATTR_RECIRC is used
- Linux kernel IPsec/ESP local delivery paths interacting with zerocopy skbs
Discovery Timeline
- 2026-09-11 - CVE-2026-80977 published to the National Vulnerability Database (NVD)
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-80977
Vulnerability Analysis
The defect is a shared-state mutation bug in the kernel socket buffer (sk_buff) layer. skb_tx_error() completes the zerocopy user argument (uarg) and clears the SKBFL_ALL_ZEROCOPY flag. skb_zcopy_downgrade_managed() clears SKBFL_MANAGED_FRAG_REFS. Both flags reside in skb_shinfo(), the shared info block that every skb clone points at. The caller, however, only owns the reference it is about to drop, not the shared page state.
When a clone drives this path, it effectively tells the zerocopy producer that its pages are free and drops SKBFL_SHARED_FRAG on behalf of skbs still in transmission. Because skb_orphan_frags() returns early on SKBFL_DONT_ORPHAN, skb_clone() does not privatise the frags for this call site, so both skbs continue to reference the same pages.
Root Cause
The root cause is improper access control over shared metadata: a per-clone error path writes into fields whose lifetime is governed by the reference count of the shared data area. This is a concurrency and state-management defect. Correct behavior is deferred cleanup via skb_release_data(), which clears the zerocopy state only when the last reference to the shared data is dropped.
Attack Vector
Exploitation requires local access and the ability to influence packet flow through Open vSwitch. An attacker triggers a flow miss on a cloned skb produced by a non-last OVS_ACTION_ATTR_RECIRC while do_execute_actions() continues to forward the original. A subsequent local ESP receive path then decrypts in place into fragments no longer treated as shared, producing kernel memory corruption over data still referenced by the in-flight skb. The impact spans confidentiality, integrity, and availability of the host kernel.
No verified public proof-of-concept is available. Technical details are documented in the upstream fix commits referenced by the NVD entry, including Kernel Commit f66bdb1cc0fc and Kernel Commit 0370da114a.
Detection Methods for CVE-2026-80977
Indicators of Compromise
- Unexpected kernel oops or BUG: messages originating in skb_release_data, sock_zerocopy_callback, or ESP receive functions on hosts running Open vSwitch.
- KASAN use-after-free or slab-out-of-bounds reports referencing skb_shared_info or page fragments on OVS-enabled kernels.
- Sporadic packet corruption or checksum failures on flows that traverse OVS_ACTION_ATTR_RECIRC with subsequent IPsec/ESP delivery.
Detection Strategies
- Enable KASAN and CONFIG_DEBUG_NET on test kernels to surface shared skb state violations during OVS and IPsec workloads.
- Correlate kernel ring buffer traces (dmesg) with OVS datapath counters for flow misses on recirculated flows.
- Monitor process privilege context around OVS control paths (ovs-vswitchd, netlink writers) for anomalous local actors modifying flow tables.
Monitoring Recommendations
- Ingest /var/log/kern.log and journalctl -k into a central data lake and alert on stack traces containing skb_tx_error, skb_zcopy, or esp_input.
- Track kernel version and patch state across the fleet to identify hosts still running unpatched stable branches.
- Alert on new local users or containers acquiring CAP_NET_ADMIN, which is a prerequisite for programming OVS flows.
How to Mitigate CVE-2026-80977
Immediate Actions Required
- Update to a Linux kernel that includes the upstream fix from the commits referenced by the NVD entry for CVE-2026-80977.
- Prioritize patching hosts that run Open vSwitch together with IPsec/ESP endpoints, as these combine the vulnerable code paths.
- Restrict CAP_NET_ADMIN and OVS control-plane access to trusted administrators to reduce the local attack surface.
Patch Information
The fix skips the shared-state mutation in skb_tx_error() when the skb is cloned, relying on skb_release_data() to clear zerocopy state once the last reference to the shared data is dropped. Distribution kernels should pick up the backports from commits f66bdb1cc0fc, 0370da114a, 15aa81b390d, 288f9970670, 363c4252ffc, 6493165034b, 6ec22afc82a, and b4452349dcf.
Workarounds
- Where feasible, avoid Open vSwitch flow rules that use non-last OVS_ACTION_ATTR_RECIRC actions on paths that terminate in local IPsec/ESP delivery.
- Disable or reroute IPsec/ESP termination away from OVS-managed hosts until kernels are patched.
- Constrain local user access on OVS-hosting nodes and enforce mandatory access control (SELinux, AppArmor) around networking daemons.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.