{"api_version":"1","generated_at":"2026-09-16T16:13:33+00:00","cve":"CVE-2026-90049","urls":{"html":"https://cve.report/CVE-2026-90049","api":"https://cve.report/api/cve/CVE-2026-90049.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-90049","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-90049"},"summary":{"title":"net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()\n\nskb_zerocopy() copies frags from @from into @to. On an\nskb_orphan_frags() failure it calls skb_tx_error(@from), a destructive\noperation on the source skb the copy helper does not own. That completes\n@from's zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, including the\nSKBFL_SHARED_FRAG page-ownership marker.\n\nBoth callers already report the failure on their own drop path.\nnfnetlink_queue does it at nla_put_failure, and Open vSwitch does it in\nthe flow-miss drop arm of ovs_dp_process_packet(), so nothing is lost by\ndropping it here.\n\nOn Open vSwitch's OVS_ACTION_ATTR_USERSPACE path the skb is not freed on\nthis error: do_execute_actions() ignores output_userspace()'s return\nvalue and, unless the upcall was the last action, keeps forwarding the\nsame skb through the flow's remaining actions. The uarg is completed\nwhile that skb is still in flight, telling the producer its buffers are\nfree, and SKBFL_SHARED_FRAG is cleared on an skb the rest of the stack\nstill handles. That flag is what makes esp_input() call skb_cow_data()\ninstead of decrypting in place, so a later local ESP delivery can\ndecrypt over frags the skb does not own privately.\n\nLeave error reporting to the callers.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-16 11:17:18","updated_at":"2026-09-16 15:18:27"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"9.3","severity":"CRITICAL","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"9.3","severity":"CRITICAL","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","data":{"baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/04dd250a78e268af3e7124beb1dc10ec1dd88d60","name":"https://git.kernel.org/stable/c/04dd250a78e268af3e7124beb1dc10ec1dd88d60","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/8069643ae64dfdf634b6c78c7f622e5323031436","name":"https://git.kernel.org/stable/c/8069643ae64dfdf634b6c78c7f622e5323031436","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a13b1e80e5015cd732440b475c0ef443dc4a2157","name":"https://git.kernel.org/stable/c/a13b1e80e5015cd732440b475c0ef443dc4a2157","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/849bdb83123760a865bcb2970127f4c0b9423ba3","name":"https://git.kernel.org/stable/c/849bdb83123760a865bcb2970127f4c0b9423ba3","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/767ec2a65cc022d303b0c9c12811e7db22057341","name":"https://git.kernel.org/stable/c/767ec2a65cc022d303b0c9c12811e7db22057341","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/fb10e0e9b220a2eed08931a60dbaad9a2370c908","name":"https://git.kernel.org/stable/c/fb10e0e9b220a2eed08931a60dbaad9a2370c908","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/8ece906150128d5ec2462aabcc978c568433eca4","name":"https://git.kernel.org/stable/c/8ece906150128d5ec2462aabcc978c568433eca4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/bab5a851e44a3601d31f2aa8043f385bb50ac5d9","name":"https://git.kernel.org/stable/c/bab5a851e44a3601d31f2aa8043f385bb50ac5d9","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90049","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90049","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 36d5fe6a000790f56039afe26834265db0a3ad4c 849bdb83123760a865bcb2970127f4c0b9423ba3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 36d5fe6a000790f56039afe26834265db0a3ad4c fb10e0e9b220a2eed08931a60dbaad9a2370c908 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 36d5fe6a000790f56039afe26834265db0a3ad4c 767ec2a65cc022d303b0c9c12811e7db22057341 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 36d5fe6a000790f56039afe26834265db0a3ad4c 8069643ae64dfdf634b6c78c7f622e5323031436 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 36d5fe6a000790f56039afe26834265db0a3ad4c 04dd250a78e268af3e7124beb1dc10ec1dd88d60 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 36d5fe6a000790f56039afe26834265db0a3ad4c a13b1e80e5015cd732440b475c0ef443dc4a2157 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 36d5fe6a000790f56039afe26834265db0a3ad4c bab5a851e44a3601d31f2aa8043f385bb50ac5d9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 36d5fe6a000790f56039afe26834265db0a3ad4c 8ece906150128d5ec2462aabcc978c568433eca4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c5f0c0e7525443add533495e93ba8de6feab2396 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1674b4bf3eea3cac51b70778e89f8025f7cfe695 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.10.51 3.11 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.12.40 3.13 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.14","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 3.14 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.270 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.221 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.188 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.157 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.110 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.51 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.5 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/core/skbuff.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"849bdb83123760a865bcb2970127f4c0b9423ba3","status":"affected","version":"36d5fe6a000790f56039afe26834265db0a3ad4c","versionType":"git"},{"lessThan":"fb10e0e9b220a2eed08931a60dbaad9a2370c908","status":"affected","version":"36d5fe6a000790f56039afe26834265db0a3ad4c","versionType":"git"},{"lessThan":"767ec2a65cc022d303b0c9c12811e7db22057341","status":"affected","version":"36d5fe6a000790f56039afe26834265db0a3ad4c","versionType":"git"},{"lessThan":"8069643ae64dfdf634b6c78c7f622e5323031436","status":"affected","version":"36d5fe6a000790f56039afe26834265db0a3ad4c","versionType":"git"},{"lessThan":"04dd250a78e268af3e7124beb1dc10ec1dd88d60","status":"affected","version":"36d5fe6a000790f56039afe26834265db0a3ad4c","versionType":"git"},{"lessThan":"a13b1e80e5015cd732440b475c0ef443dc4a2157","status":"affected","version":"36d5fe6a000790f56039afe26834265db0a3ad4c","versionType":"git"},{"lessThan":"bab5a851e44a3601d31f2aa8043f385bb50ac5d9","status":"affected","version":"36d5fe6a000790f56039afe26834265db0a3ad4c","versionType":"git"},{"lessThan":"8ece906150128d5ec2462aabcc978c568433eca4","status":"affected","version":"36d5fe6a000790f56039afe26834265db0a3ad4c","versionType":"git"},{"status":"affected","version":"c5f0c0e7525443add533495e93ba8de6feab2396","versionType":"git"},{"status":"affected","version":"1674b4bf3eea3cac51b70778e89f8025f7cfe695","versionType":"git"},{"lessThan":"3.11","status":"affected","version":"3.10.51","versionType":"semver"},{"lessThan":"3.13","status":"affected","version":"3.12.40","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/core/skbuff.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.14"},{"lessThan":"3.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.270","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.221","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.188","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.157","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.110","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.51","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.270","versionStartIncluding":"3.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.221","versionStartIncluding":"3.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.188","versionStartIncluding":"3.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.157","versionStartIncluding":"3.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.110","versionStartIncluding":"3.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.51","versionStartIncluding":"3.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.5","versionStartIncluding":"3.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"3.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10.51","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12.40","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()\n\nskb_zerocopy() copies frags from @from into @to. On an\nskb_orphan_frags() failure it calls skb_tx_error(@from), a destructive\noperation on the source skb the copy helper does not own. That completes\n@from's zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, including the\nSKBFL_SHARED_FRAG page-ownership marker.\n\nBoth callers already report the failure on their own drop path.\nnfnetlink_queue does it at nla_put_failure, and Open vSwitch does it in\nthe flow-miss drop arm of ovs_dp_process_packet(), so nothing is lost by\ndropping it here.\n\nOn Open vSwitch's OVS_ACTION_ATTR_USERSPACE path the skb is not freed on\nthis error: do_execute_actions() ignores output_userspace()'s return\nvalue and, unless the upcall was the last action, keeps forwarding the\nsame skb through the flow's remaining actions. The uarg is completed\nwhile that skb is still in flight, telling the producer its buffers are\nfree, and SKBFL_SHARED_FRAG is cleared on an skb the rest of the stack\nstill handles. That flag is what makes esp_input() call skb_cow_data()\ninstead of decrypting in place, so a later local ESP delivery can\ndecrypt over frags the skb does not own privately.\n\nLeave error reporting to the callers."}],"metrics":[{"cvssV3_1":{"baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - skb_zerocopy() only skb_tx_error()s the source when skb_orphan_frags() fails, which requires a still-attached zerocopy uarg without SKBFL_DONT_ORPHAN (vhost-net, xen-netback, AF_PACKET mmap); ordinary remote NIC packets never carry that uarg.\nAC:L - The attacker drives zerocopy TX and can fail skb_copy_ubufs() without an uncontrolled race (non-last OVS OUTPUT clones the skb so skb_shared() is set, or induced GFP_ATOMIC pressure); do_execute_actions() ignores the USERSPACE error and keeps forwarding.\nPR:N - A KVM/Xen guest using vhost-net or xen-netback needs no host account, capability, or /dev/vhost-net fd—only virtio/netback TX on the provisioned vNIC.\nUI:N - Guest or local zerocopy TX and in-kernel OVS USERSPACE-then-forward processing run without the victim mounting, opening a file, or otherwise interacting.\nS:C - vhost-net and xen-netback are host/Dom0 kernel code on the guest NIC boundary; premature uarg completion and SKBFL_SHARED_FRAG removal run in host context from guest zerocopy TX, impacting host kernel state outside the guest authority.\nC:H - skb_tx_error() completes the uarg while the skb is still forwarded and clears SKBFL_SHARED_FRAG, so later esp_input() skips skb_cow_data() and decrypts in place over producer-reused frags, a UAF/in-place primitive that can disclose host-held page contents.\nI:H - In-place ESP decrypt over frags the skb does not own privately, plus premature zerocopy completion, writes attacker-influenced data into pages still referenced by the in-flight host skb, a write primitive suitable for integrity compromise and control-flow impact.\nA:H - Reuse of zerocopy pages still referenced by the forwarded skb, and in-place overwrites of those pages, cause host oopses and panics that can be retriggered from guest or local TX until the host is unavailable."}]}],"providerMetadata":{"dateUpdated":"2026-09-16T14:42:05.924Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/849bdb83123760a865bcb2970127f4c0b9423ba3"},{"url":"https://git.kernel.org/stable/c/fb10e0e9b220a2eed08931a60dbaad9a2370c908"},{"url":"https://git.kernel.org/stable/c/767ec2a65cc022d303b0c9c12811e7db22057341"},{"url":"https://git.kernel.org/stable/c/8069643ae64dfdf634b6c78c7f622e5323031436"},{"url":"https://git.kernel.org/stable/c/04dd250a78e268af3e7124beb1dc10ec1dd88d60"},{"url":"https://git.kernel.org/stable/c/a13b1e80e5015cd732440b475c0ef443dc4a2157"},{"url":"https://git.kernel.org/stable/c/bab5a851e44a3601d31f2aa8043f385bb50ac5d9"},{"url":"https://git.kernel.org/stable/c/8ece906150128d5ec2462aabcc978c568433eca4"}],"title":"net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-90049","datePublished":"2026-09-16T10:33:45.259Z","dateReserved":"2026-09-11T19:38:34.783Z","dateUpdated":"2026-09-16T14:42:05.924Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-16 11:17:18","lastModifiedDate":"2026-09-16 15:18:27","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"90049","Ordinal":"1","Title":"net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy","CVE":"CVE-2026-90049","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"90049","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()\n\nskb_zerocopy() copies frags from @from into @to. On an\nskb_orphan_frags() failure it calls skb_tx_error(@from), a destructive\noperation on the source skb the copy helper does not own. That completes\n@from's zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, including the\nSKBFL_SHARED_FRAG page-ownership marker.\n\nBoth callers already report the failure on their own drop path.\nnfnetlink_queue does it at nla_put_failure, and Open vSwitch does it in\nthe flow-miss drop arm of ovs_dp_process_packet(), so nothing is lost by\ndropping it here.\n\nOn Open vSwitch's OVS_ACTION_ATTR_USERSPACE path the skb is not freed on\nthis error: do_execute_actions() ignores output_userspace()'s return\nvalue and, unless the upcall was the last action, keeps forwarding the\nsame skb through the flow's remaining actions. The uarg is completed\nwhile that skb is still in flight, telling the producer its buffers are\nfree, and SKBFL_SHARED_FRAG is cleared on an skb the rest of the stack\nstill handles. That flag is what makes esp_input() call skb_cow_data()\ninstead of decrypting in place, so a later local ESP delivery can\ndecrypt over frags the skb does not own privately.\n\nLeave error reporting to the callers.","Type":"Description","Title":"net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy"}]}}}