CVE-2026-89487: Linux Kernel Privilege Escalation Flaw

CVE-2026-89487 Overview

CVE-2026-89487 is a Linux kernel vulnerability in the Open vSwitch (OVS) datapath. The flaw resides in queue_userspace_packet(), which incorrectly calls skb_tx_error() on a live socket buffer (skb) it does not own. This clears the SKBFL_SHARED_FRAG flag on a still-forwarded packet carrying MSG_ZEROCOPY page-cache fragments. Later local ESP-in-UDP delivery through esp_input() then performs in-place AEAD decryption over user pages, yielding an unprivileged page-cache write primitive known as "Fragnesia." A local, low-privileged attacker can corrupt page-cache contents, compromising confidentiality, integrity, and availability.

Critical Impact
Local attackers can gain an unprivileged page-cache write primitive, enabling data corruption and potential privilege escalation on affected Linux kernels using Open vSwitch with IPsec.

Affected Products

Linux kernel with Open vSwitch (openvswitch) datapath compiled and in use
Systems with ESP-in-UDP (IPsec) processing via esp_input()
Kernels prior to fix commits 0dbc2398, 4477222e, 48db11e1, 4d5c460e, 5d85eef2, 5de5d554, 6767d70c, and e41a59fc

Discovery Timeline

2026-09-11 - CVE-2026-89487 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89487

Vulnerability Analysis

The vulnerability is a kernel-level data integrity flaw in net/openvswitch/. When Open vSwitch executes a USERSPACE action, queue_userspace_packet() copies the packet into a private netlink message (user_skb) but does not take ownership of the original skb. Control returns to do_execute_actions(), which continues processing remaining flow actions on the same skb.

The error path in queue_userspace_packet() incorrectly invokes skb_tx_error(skb). Per kernel documentation, skb_tx_error() requires the caller to free the skb afterwards, because internally skb_zcopy_clear() executes skb_shinfo(skb)->flags &= ~SKBFL_ALL_ZEROCOPY, stripping the SKBFL_SHARED_FRAG bit.

do_execute_actions() ignores the return value from output_userspace(), so subsequent actions inherit the now-mutated skb with stripped flags.

Root Cause

The defect exists in the flow-execution error handling introduced by commit 36d5fe6a0007 ("core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors"). The call was harmless historically. It became exploitable once esp_input() began relying on SKBFL_SHARED_FRAG to gate skb_cow_data() before in-place Authenticated Encryption with Associated Data (AEAD) decryption. Stripping the flag on a live skb removes the copy-on-write guarantee.

Attack Vector

A local unprivileged attacker crafts MSG_ZEROCOPY sendmsg traffic whose fragments reference read-only page-cache pages. The attacker routes this traffic through an OVS flow containing a USERSPACE action that fails, followed by an ESP-in-UDP output action delivered locally. The subsequent in-place AEAD decrypt writes attacker-controlled plaintext directly into page-cache pages the sender does not own, achieving arbitrary page-cache corruption.

See the kernel commit 6767d70c for the corrective patch that moves skb_tx_error() to the flow-miss drop path before kfree_skb().

Detection Methods for CVE-2026-89487

Indicators of Compromise

Unexpected modifications to files backed by shared page-cache pages after IPsec traffic activity
Kernel warnings or crashes in esp_input() or openvswitch action processing paths
Anomalous ESP-in-UDP flows terminating locally alongside OVS USERSPACE upcall failures

Detection Strategies

Audit running kernel versions against fixed stable-tree commits listed in the vendor references
Monitor for local processes issuing MSG_ZEROCOPY sendmsg calls combined with IPsec traffic through OVS datapaths
Correlate openvswitch upcall failure counters with subsequent unexplained file integrity changes

Monitoring Recommendations

Enable kernel audit logging for openvswitch module load events and OVS flow modifications
Track IPsec Security Association usage on hosts running openvswitch to identify unusual local ESP-in-UDP delivery
Deploy file integrity monitoring on sensitive files that may reside in shared page cache

How to Mitigate CVE-2026-89487

Immediate Actions Required

Update to a Linux kernel release that includes one of the fix commits (0dbc2398, 4477222e, 48db11e1, 4d5c460e, 5d85eef2, 5de5d554, 6767d70c, e41a59fc)
Inventory hosts running Open vSwitch with IPsec enabled and prioritize them for patching
Restrict local shell access on affected hosts until patches are deployed

Patch Information

The upstream fix moves the skb_tx_error() call to the flow-miss drop path in the default branch of ovs_dp_process_packet()'s switch(error) before kfree_skb(). This ensures skb_tx_error() runs only on packets about to be freed. Patches are available across stable branches — see the kernel commit e41a59fc and the kernel commit 4d5c460e for representative backports.

Workarounds

Disable the openvswitch kernel module on hosts that do not require it: modprobe -r openvswitch
Avoid deploying OVS flows that combine USERSPACE upcall actions with subsequent ESP-in-UDP output actions on the same flow
Disable local ESP-in-UDP IPsec termination on hosts running OVS until patched

bash

# Verify running kernel and check for fix commits in the changelog
uname -r
rpm -q --changelog kernel | grep -E '0dbc2398|4477222e|48db11e1|4d5c460e|5d85eef2|5de5d554|6767d70c|e41a59fc'

# Temporary mitigation: unload the openvswitch module if not required
sudo modprobe -r openvswitch

# Prevent automatic reload
echo 'blacklist openvswitch' | sudo tee /etc/modprobe.d/disable-openvswitch.conf