CVE-2026-90049: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-90049 Overview

CVE-2026-90049 is a Linux kernel vulnerability in the network stack's skb_zerocopy() function within net/core/skbuff.c. The function copies fragments from a source socket buffer (skb) into a destination skb. On an skb_orphan_frags() failure, it incorrectly invokes skb_tx_error() on the source skb, a destructive operation on memory the copy helper does not own. The call completes the source skb's zerocopy uarg and clears the SKBFL_SHARED_FRAG page-ownership marker while the buffer is still in flight, enabling downstream code paths to operate on fragments the skb does not privately own.

Critical Impact
A local attacker leveraging Open vSwitch or nfnetlink_queue paths can trigger premature completion of zerocopy user arguments and corrupt shared fragment state, leading to potential memory corruption during subsequent ESP decryption.

Affected Products

Linux kernel network subsystem (net/core/skbuff.c)
Open vSwitch (OVS_ACTION_ATTR_USERSPACE action path)
nfnetlink_queue (netfilter userspace queue interface)

Discovery Timeline

2026-09-16 - CVE-2026-90049 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90049

Vulnerability Analysis

The defect resides in skb_zerocopy(), a helper that copies fragment references from @from into @to. When skb_orphan_frags() fails, the current implementation calls skb_tx_error(@from). That call is destructive: it completes the source skb's zerocopy user argument (uarg) and clears SKBFL_ALL_ZEROCOPY, including the SKBFL_SHARED_FRAG marker that tracks page ownership.

Both in-tree callers already report the failure themselves. nfnetlink_queue reports at its nla_put_failure label, and Open vSwitch reports in the flow-miss drop arm of ovs_dp_process_packet(). On the OVS_ACTION_ATTR_USERSPACE path, however, do_execute_actions() ignores the return value of output_userspace(). Unless the upcall is the last action, the same skb continues through the flow's remaining actions with its uarg already completed.

Root Cause

The root cause is improper ownership handling in a shared helper. skb_zerocopy() does not own the source skb but performs a destructive teardown on it during error handling. Completing the uarg signals the producer that its buffers are free while the buffer is still referenced by an in-flight skb. Clearing SKBFL_SHARED_FRAG is particularly damaging because esp_input() relies on that flag to decide whether to call skb_cow_data(). Without the flag, later local ESP delivery can decrypt in place over fragments the skb does not privately own.

Attack Vector

Exploitation requires local access to trigger the Open vSwitch userspace-action path or nfnetlink_queue under conditions that force skb_orphan_frags() to fail. A local attacker who influences packet flow through affected code paths can force premature uarg completion, race the producer's buffer reuse, and coerce ESP input processing to operate on fragments whose backing pages are not privately owned. The result is a memory-corruption primitive affecting confidentiality, integrity, and availability of the kernel.

No verified public proof-of-concept code is available. Technical detail resides in the upstream kernel commits listed under references.

Detection Methods for CVE-2026-90049

Indicators of Compromise

Unexpected kernel warnings or oops messages referencing skb_zerocopy, skb_orphan_frags, or esp_input in dmesg and /var/log/kern.log.
Anomalous crashes or memory-corruption signatures in hosts running Open vSwitch with userspace upcall actions or workloads using nfnetlink_queue.
Unexplained IPsec/ESP decryption failures or malformed packets following heavy Open vSwitch flow-miss activity.

Detection Strategies

Monitor kernel logs for stack traces originating in skb_zerocopy() or skb_tx_error() code paths.
Correlate Open vSwitch upcall volume and nfnetlink_queue error rates with kernel warning bursts to surface abnormal flow-miss patterns.
Track loaded kernel versions across the fleet and flag hosts still running unpatched stable series identified by the upstream fix commits.

Monitoring Recommendations

Enable kernel crash collection (kdump) on Open vSwitch data-plane and netfilter userspace-queue hosts to preserve forensic evidence.
Alert on repeated skb_orphan_frags() allocation failures, which typically indicate memory pressure that can be weaponized to trigger the bug.
Baseline ESP/IPsec error counters (ip -s xfrm stats) and alert on sudden increases on hosts running the affected paths.

How to Mitigate CVE-2026-90049

Immediate Actions Required

Inventory Linux hosts running Open vSwitch or nfnetlink_queue consumers and prioritize them for patching.
Apply the upstream stable kernel patches referenced below and reboot affected systems into the fixed kernel.
Restrict local access on multi-tenant hosts until patched kernels are deployed, since the attack vector is local.

Patch Information

The fix removes the erroneous skb_tx_error() call in skb_zerocopy() and leaves error reporting to the callers. Patches are available in the following upstream commits:

Consume the fix through your distribution's stable kernel updates once available.

Workarounds

Where feasible, disable Open vSwitch flows that rely on OVS_ACTION_ATTR_USERSPACE upcalls until the fixed kernel is deployed.
Where feasible, remove or restrict use of nfnetlink_queue consumers on exposed hosts until patched.
Enforce least-privilege access to reduce the pool of users who can influence the affected code paths on shared systems.

bash

# Verify the running kernel and check for the fixed commit in your distribution changelog
uname -r
rpm -q --changelog kernel | head -n 50   # RHEL/Fedora
apt changelog linux-image-$(uname -r) | head -n 50   # Debian/Ubuntu