Loading vulnerability…
Linux kernel skb_zerocopy shared-fragment ownership corruption
CVE-2026-90049 is a Linux kernel networking vulnerability caused by destructive error handling in skb_zerocopy(). When skb_orphan_frags() fails, the helper incorrectly calls skb_tx_error() on a source socket buffer it does not own. This prematurely completes the zerocopy user argument and clears SKBFL_ALL_ZEROCOPY, including the SKBFL_SHARED_FRAG ownership marker. On the Open vSwitch OVS_ACTION_ATTR_USERSPACE path, do_execute_actions() ignores output_userspace() failures and can continue processing the same buffer through subsequent actions. Later local ESP processing can consequently bypass the copy-on-write protection normally selected by SKBFL_SHARED_FRAG and decrypt directly into shared fragments. The vulnerability is part of a shared-fragment marker-stripping issue that enables local privilege escalation through modification of protected file page-cache pages.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The defect breaks buffer-lifetime and page-ownership guarantees: a producer can be told its zerocopy buffers are available while the packet remains in flight, and ESP processing can modify pages the packet does not privately own. In the described local exploitation chain, an unprivileged attacker can cause chosen-content writes into the page cache of a root-owned file, including a setuid executable, and obtain root privileges by executing the modified image. ESP authentication failure does not prevent the preceding decryption writes. These modifications can remain memory-resident without changing the on-disk file. Successful privilege escalation compromises host confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
Where Open vSwitch is unnecessary, prevent its kernel module from loading using an install-rule restriction rather than relying solely on module blacklisting. Where IPsec termination is unnecessary and ESP support is modular, prevent the esp4 and esp6 modules from loading. Disabling unprivileged user namespaces removes the namespace-based capability source used by the described exploit, but can disrupt containers and application sandboxes. These measures reduce exposure to the documented chain and do not replace kernel updates.
Patch, then assume compromise.
Install the applicable distribution kernel security update and boot into the fixed kernel. The direct fix removes skb_tx_error() on the source buffer from skb_zerocopy() error handling, leaving failure reporting to callers. Deploy the complete vendor patch set for the related Open vSwitch shared-fragment issue, including protections preventing skb_tx_error() from changing shared-info state still required by forwarded buffers or clones. A single universal fixed upstream kernel version is not established here; use the vendor's release- and kernel-flavor-specific advisory.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.