Look up another CVE · open CVE-2026-80977 in the interactive tracker
CVE-2026-80977
net: skbuff: don't touch shared zerocopy state in skb_tx_error()
Published 2026-09-11 (37 days ago) by the Linux kernel CNA. Subsystem net/core. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-80977 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
skb_tx_error() completes the zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, and skb_zcopy_downgrade_managed() clears SKBFL_MANAGED_FRAG_REFS. Both live in skb_shinfo(), which every clone shares, while the caller only owns the reference it is about to drop. Through a clone it tells the producer its pages are free and drops SKBFL_SHARED_FRAG for an skb that is still in flight. Open vSwitch reaches this with a non-last OVS_ACTION_ATTR_RECIRC: clone_execute() sends a skb_clone() into ovs_dp_process_packet() while do_execute_actions() keeps forwarding the original, and skb_clone() does not privatise the frags here -- skb_orphan_frags() returns early on SKBFL_DONT_ORPHAN. A flow miss on the clone then strips the marker from the packet still being forwarded, and a later local ESP delivery decrypts in place over frags it does not own privately. Skip it for a cloned skb. Nothing is lost: skb_release_data() clears the zerocopy state once the last reference to the shared data goes.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/core/skbuff.c
- What this is
- NETWORKING [GENERAL]MAINTAINERS section matched on net/ · netdev@vger.kernel.org · Maintained
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12y
- y
- built into the kernel image on every flavour - only a patch removes it
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages
Signals
- Published
- 2026-09-11 (37 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/core
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.8 | 5.10.270 | 6493165034bc |
| 3.8 | 5.15.221 | b4452349dcf4 |
| 3.8 | 6.1.188 | 363c4252ffc4 |
| 3.8 | 6.6.157 | 6ec22afc82a3 |
| 3.8 | 6.12.109 | 15aa81b390d4 |
| 3.8 | 6.18.50 | 288f99706708 |
| 3.8 | 7.2.4 | 0370da114a9b |
| 3.8 | 7.3 | f66bdb1cc0fc |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The buggy state is a locally originated MSG_ZEROCOPY/io_uring TX skb (SKBFL_DONT_ORPHAN plus a uarg); NIC-received packets never carry that marker, and the skb must still be forwarded into local ESP, so a local account is required.
- AC:LAttack complexity, low
- The attacker fully controls both sides: OVS flows with a non-last RECIRC, a guaranteed miss/upcall failure on the clone, MSG_ZEROCOPY send, and the ESP SA/payload, so the shared-shinfo strip and in-place decrypt are reliably reproducible with no race beyond attacker influence.
- PR:LPrivileges required, low
- An unprivileged user can enable SO_ZEROCOPY and, via unshare -Urn, obtain CAP_NET_ADMIN in a user+net namespace; OVS genetlink uses GENL_UNS_ADMIN_PERM and XFRM SAs are likewise namespace-installable, while the global page cache remains the corruption target.
- UI:NUser interaction, none
- The attacker installs the OVS recirc flow, sends the MSG_ZEROCOPY packet, and completes local ESP delivery without any victim action.
- S:UScope, unchanged
- The resulting page-cache write and premature zerocopy completion stay inside the host kernel's memory authority as a standard local memory-corruption/LPE primitive and do not cross a VM or IOMMU boundary.
- C:HConfidentiality impact, high
- skb_tx_error() on the clone completes the shared uarg and clears SKBFL_SHARED_FRAG, so later in-place ESP decrypt (and UAF of still-mapped pages) corrupts globally cached file/code pages and can be leveraged for arbitrary disclosure.
- I:HIntegrity impact, high
- With the shared-frag marker stripped, esp_input() skips skb_cow_data() and AEAD-decrypts attacker-controlled plaintext in place over page-cache-backed frags, yielding an unprivileged write into files the sender could only read (the Fragnesia primitive).
- A:HAvailability impact, high
- Use-after-free of zerocopy pages still referenced by the in-flight original skb, plus overwriting page-cache-backed executable or kernel-managed data, causes oopses, panics, and process crashes.