net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
Affects Linux kernel from 3.14.0 in the listed branches, with fixes in stable releases such as 5.10.270, 6.1.188, 6.12.110 and 7.2.5. No vendor severity rating is given.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 3.11, 3.13, 5.10.270, 5.15.221, 6.1.188, and 4 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The fix addresses the Linux kernel's network buffer handling (skbuff zerocopy path), which is used by components such as netfilter's nfnetlink_queue and Open vSwitch. On certain error conditions, the kernel could improperly complete zerocopy buffers and clear page-ownership markers on packets still in flight, which could lead to memory-ownership confusion during later packet processing.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() skb_zerocopy() copies frags from @from into @to. On an skb_orphan_frags() failure it calls skb_tx_error(@from), a destructive operation on the source skb the copy helper does not own. That completes @from's zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, including the SKBFL_SHARED_FRAG page-ownership marker. Both callers already report the failure on their own drop path. nfnetlink_queue does it at nla_put_failure, and Open vSwitch does it in the flow-miss drop arm of ovs_dp_process_packet(), so nothing is lost by dropping it here. On Open vSwitch's OVS_ACTION_ATTR_USERSPACE path the skb is not freed on this error: do_execute_actions() ignores output_userspace()'s return value and, unless the upcall was the last action, keeps forwarding the same skb through the flow's remaining actions. The uarg is completed while that skb is still in flight, telling the producer its buffers are free, and SKBFL_SHARED_FRAG is cleared on an skb the rest of the stack still handles. That flag is what makes esp_input() call skb_cow_data() instead of decrypting in place, so a later local ESP delivery can decrypt over frags the skb does not own privately. Leave error reporting to the callers.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 36d5fe6a000790f56039afe26834265db0a3ad4c · fixed in 849bdb83123760a865bcb2970127f4c0b9423ba3; From 36d5fe6a000790f56039afe26834265db0a3ad4c · fixed in fb10e0e9b220a2eed08931a60dbaad9a2370c908; From 36d5fe6a000790f56039afe26834265db0a3ad4c · fixed in 767ec2a65cc022d303b0c9c12811e7db22057341; From 36d5fe6a000790f56039afe26834265db0a3ad4c · fixed in 8069643ae64dfdf634b6c78c7f622e5323031436; From 36d5fe6a000790f56039afe26834265db0a3ad4c · fixed in 04dd250a78e268af3e7124beb1dc10ec1dd88d60; From 36d5fe6a000790f56039afe26834265db0a3ad4c · fixed in a13b1e80e5015cd732440b475c0ef443dc4a2157; From 36d5fe6a000790f56039afe26834265db0a3ad4c · fixed in bab5a851e44a3601d31f2aa8043f385bb50ac5d9; From 36d5fe6a000790f56039afe26834265db0a3ad4c · fixed in 8ece906150128d5ec2462aabcc978c568433eca4; From 3.10.51 · fixed in 3.11; From 3.12.40 · fixed in 3.13
- Linux Linux
3.14
- KernelLinux
From 3.14.0 · fixed in 5.10.270; From 5.11.0 · fixed in 5.15.221; From 5.16.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.51; From 6.19.0 · fixed in 7.2.5
References 8
git.kernel.org
- stable/c/849bdb83123760a865bcb2970127f4c0b9423ba3
- stable/c/fb10e0e9b220a2eed08931a60dbaad9a2370c908
- stable/c/767ec2a65cc022d303b0c9c12811e7db22057341
- stable/c/8069643ae64dfdf634b6c78c7f622e5323031436
- stable/c/04dd250a78e268af3e7124beb1dc10ec1dd88d60
- stable/c/a13b1e80e5015cd732440b475c0ef443dc4a2157
- stable/c/bab5a851e44a3601d31f2aa8043f385bb50ac5d9
- stable/c/8ece906150128d5ec2462aabcc978c568433eca4
Questions about CVE-2026-90049
What does this mean?
When a kernel check for shared memory fragments fails during a zero-copy send, the kernel still clears the markers that mark the source buffer as zero-copy and shared. A later local ESP decryption can then run in place over fragments the buffer does not privately own.Source: git.kernel.org
Am I affected, and how do I check?
The affected range starts at kernel 3.14.0 and runs up to the fixed release of each branch, including 3.11 and 3.13 for older series. To check a system, run uname -r and compare the version against the listed ranges for its branch. The bug only applies when the skb_orphan_frags() failure path runs inside skb_zerocopy().Source: git.kernel.org
What should I do about it?
Update to the fixed kernel release for your branch: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, or 7.2.5. Distribution kernels may carry the fix under a different version number, so check your vendor's advisory.Source: git.kernel.org
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data