New LPE bug family: Open vSwitch strips SKBFL_SHARED_FRAG from a live forwarded skb, reopening the Fragnesia page-cache write primitive. Deterministic root on default Arch, Fedora, Debian, Amazon Linux, and RHEL with no race condition required. Tracked as CVE-2026-90049, CVE-2026-89487, and CVE-2026-80977. Public since 2026-08-13, fixed in mainline and stable on 2026-09-04. Actively exploitable on unpatched kernels today. - Root cause is in queue_userspace_packet() inside net/openvswitch/datapath.c. When an OVS upcall fails, skb_tx_error() calls skb_zcopy_clear(), which clears the entire SKBFL_ALL_ZEROCOPY group including SKBFL_SHARED_FRAG. Because do_execute_actions() ignores the upcall return value, the same skb, now missing its ownership marker but still carrying foreign page-cache frags, continues down the action pipeline to OUTPUT. If that output reaches esp_input(), the gate at skb_has_shared_frag() passes and the in-place AES-GCM decrypt writes attacker-controlled plaintext directly into the page-cache folio. - Exploitation requires three things an unprivileged user can satisfy: CAP_NET_ADMIN inside a user namespace (GENL_UNS_ADMIN_PERM on all OVS genl ops, so unshare -Urn is enough), openvswitch.ko autoloading on first genl family resolution (no CAP_SYS_MODULE needed), and an MSG_ZEROCOPY send over a PROT_READ MAP_SHARED mapping of a root-owned file so SKBFL_DONT_ORPHAN keeps the page-cache frag from being copied during the upcall. #DFIR_Radar
Post summary
The post discloses multiple Open vSwitch vulnerabilities (CVE-2026-90049, CVE-2026-89487, CVE-2026-80977) with detailed technical exploitation logic confirming active attacks on unpatched systems, and references a patch released on 2026-09-04.
