Loading vulnerability…
Linux Open vSwitch shared-fragment protection bypass leading to local privilege escalation
CVE-2026-89487 is an error-handling vulnerability in the Linux kernel Open vSwitch datapath. On a failed USERSPACE upcall, queue_userspace_packet() calls skb_tx_error() on a borrowed packet buffer that remains available for subsequent flow actions. Through skb_zcopy_clear(), this clears SKBFL_SHARED_FRAG even though the packet can still reference page-cache fragments it does not own. Because do_execute_actions() ignores the failed upcall's return value, later local ESP-in-UDP processing can receive the altered packet. ESP input relies on this flag to invoke copy-on-write before in-place authenticated decryption; its removal therefore permits unauthorized modification of shared page-cache pages. The vulnerability bypasses protections associated with the Fragnesia page-cache write primitive.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A local low-privileged attacker can obtain chosen-content writes to page-cache pages belonging to files they can read but cannot modify. ESP decryption can change these pages before authentication-tag validation rejects the packet. Overwriting the cached executable contents of a setuid-root program can yield root privileges, enabling system compromise. The primitive also threatens data integrity and availability. The demonstrated page-cache modifications are not marked dirty and do not themselves change the underlying file on disk; cache eviction or reboot restores the original file contents.
If you can’t patch tonight, do this now.
Where Open vSwitch is unnecessary, prevent its kernel module from loading using an explicit module-install restriction rather than relying solely on blacklisting, and ensure it is not already active. Where IPsec termination is unnecessary, prevent the esp4 and esp6 modules from loading if they are modular. Disabling unprivileged user namespaces removes the namespace-based capability source used by the described attack, but can disrupt containers and application sandboxes. Restricting existing Open vSwitch USERSPACE flows alone is insufficient if untrusted users can create their own namespace-local datapaths.
Patch, then assume compromise.
Install the Linux distribution's kernel security update addressing CVE-2026-89487 and reboot into the corrected kernel. The Open vSwitch correction removes skb_tx_error() from the borrowed-packet USERSPACE-upcall error path and places it in the ovs_dp_process_packet() flow-miss drop path immediately before kfree_skb(). Use a vendor update incorporating the complete applicable fix series, including skb_tx_error() handling that preserves shared-info state needed by forwarded packets or clones. Unity Linux identifies its applicable update in advisory UTSA-2026-146633; an exact universally applicable fixed kernel version is not available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.