Loading vulnerability…
CVE-2026-80977 is a Linux kernel networking flaw in skb_tx_error() affecting cloned socket buffers that share skb_shared_info(). The function completes zerocopy state and clears shared zerocopy flags despite the caller holding only one reference to shared skb data. Consequently, a clone can cause shared-fragment ownership state to be removed while another skb reference remains in flight. In an Open vSwitch recirculation path, a cloned packet can encounter error handling while the original continues forwarding; subsequent local ESP processing may then decrypt in place over fragments that are not privately owned.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A CVE assigned to the reported Linux kernel/Open vSwitch shared-fragment-marker stripping vulnerability and its associated fixes. The flaw enables a deterministic local privilege escalation under the stated conditions by enabling a page-cache write primitive during ESP processing.
A vulnerability identified as CVE-2026-80977 affecting Debian Linux 12.0, 13.0, and 14.0. The supplied CVSS v3 vector indicates a local attack requiring low privileges and no user interaction, with high availability impact.
A resolved Linux kernel networking flaw in skb_tx_error() involving cloned socket buffers with shared zerocopy state. Processing a non-final Open vSwitch recirculation action can cause shared zerocopy and fragment-reference flags to be cleared while the original packet remains in flight, potentially leading to in-place ESP decryption over non-private fragments. The fix skips this handling for cloned skbs, leaving final cleanup to skb_release_data() when the last shared-data reference is released.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.