10 matches found
CVE-2026-80977
A flaw was found in the Linux kernel's networking subsystem. The skbtxerror function improperly handles shared zerocopy state in socket buffers skbs. When a cloned skb is processed, it can prematurely signal that its pages are free and drop shared fragment flags while the original skb is still in...
CVE-2026-89487
In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...
CVE-2026-80977
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo, which every clone...
CVE-2026-89487 openvswitch: only skb_tx_error() a packet we are about to drop
In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...
EUVD-2026-76393
In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...
CVE-2026-89487
In the Linux kernel's Open vSwitch subsystem, queue_userspace_packet() erroneously calls skb_tx_error() on a borrowed skb that do_execute_actions() continues to forward, stripping the SKBFL_SHARED_FRAG flag. For a MSG_ZEROCOPY skb carrying page-cache fragments, this causes a later ESP-in-UDP deli...
CVE-2026-80977 net: skbuff: don't touch shared zerocopy state in skb_tx_error()
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo, which every clone...
CVE-2026-80977
CVE-2026-80977 affects the Linux kernel networking subsystem, specifically the skbuff (socket buffer) zerocopy handling. The root cause is that skb_tx_error() modifies shared zerocopy state in skb_shinfo() —a structure shared by all clones of a socket buffer—while the caller only owns the single ...
EUVD-2026-76300
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo, which every clone...
PT-2026-90203
In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skb tx error a packet we are about to drop queue userspace packet borrows the packet skb -- it only copies it into a private netlink message user skb and does not own it; on return do execute actions keeps...