Linux Open vSwitch Flaw Enables Deterministic Local Root Escalation

Researchers disclosed a deterministic Linux local privilege-escalation primitive affecting Open vSwitch forwarding paths, tracked as CVE-2026-90049, CVE-2026-89487, and CVE-2026-80977. A failed Open vSwitch userspace upcall can invoke skb_tx_error() on an skb that remains in use, clearing ownership metadata while page-cache fragments remain attached. An unprivileged user able to create user namespaces and administer networking within their own namespace can combine MSG_ZEROCOPY, an attacker-controlled OVS datapath, and ESP-in-UDP handling to write chosen plaintext into read-only, root-owned file page-cache pages before ESP authentication fails.

The transient page-cache modification can alter an in-memory setuid-root binary and produce root privileges when that program executes. Default deployments of Arch Linux, Fedora, Debian, Amazon Linux, and Red Hat Enterprise Linux may be exposed where unprivileged user namespaces are enabled, Open vSwitch autoloads, and kernels contain the relevant Fragnesia changes. Fixes have landed upstream and began reaching stable kernels; organizations should apply vendor kernel updates and, pending patching, disable unprivileged user namespaces or prevent Open vSwitch and ESP module autoloading where operationally feasible.