CVE-2026-90049: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-90049 is a memory corruption vulnerability in the Linux kernel's skb_zerocopy() function within the network stack (net/core/skbuff.c). The flaw causes skb_tx_error() to be incorrectly called on the source socket buffer (skb) during an skb_orphan_frags() failure, destructively clearing the SKBFL_SHARED_FRAG page-ownership marker on an skb that may still be in active use. This affects Linux kernel versions from 3.14 onward, with fixes backported to stable branches including 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5, and 7.3-rc1. It was published on September 16, 2026, and carries a CVSS v3.1 base score of 9.3 (Critical) (GitHub Advisory, Feedly).

The root cause is improper resource management (CWE-404 / use-after-free-adjacent memory corruption) in skb_zerocopy(), which copies packet fragments from a source skb (@from) to a destination skb (@to). On skb_orphan_frags() failure, the function incorrectly calls skb_tx_error(@from), completing the zerocopy user-argument (uarg) and clearing SKBFL_ALL_ZEROCOPY — including the SKBFL_SHARED_FRAG flag — on an skb the function does not own. On Open vSwitch's OVS_ACTION_ATTR_USERSPACE path, do_execute_actions() ignores output_userspace()'s return value and continues forwarding the same skb through remaining flow actions; the cleared SKBFL_SHARED_FRAG flag causes esp_input() to skip the defensive skb_cow_data() copy and decrypt ESP payloads directly over shared framebuffer pages the skb no longer privately owns. Both callers (nfnetlink_queue and Open vSwitch) already handle error reporting independently, making the erroneous skb_tx_error() call in skb_zerocopy() entirely unnecessary (GitHub Advisory).

Successful exploitation allows a local attacker with the ability to send network packets through Open vSwitch to corrupt memory belonging to other processes by causing ESP decryption to write over shared framebuffer pages that should have been privately copied first. This can result in high confidentiality, integrity, and availability impact — potentially enabling local privilege escalation or arbitrary code execution within the kernel context. The vulnerability's scope is marked as Changed, meaning the impact can extend beyond the vulnerable component itself to other system resources (Feedly).

As of the disclosure date (September 16, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is reported as 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access and the ability to send network packets through Open vSwitch, limiting the practical attack surface (GitHub Advisory, Feedly).

Apply the available kernel patches that remove the erroneous skb_tx_error(@from) call from skb_zerocopy(), leaving error reporting to the callers. Fixed versions are available across all active stable branches: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5, and 7.3-rc1. As a short-term workaround where patching is not immediately possible, restricting local user access to Open vSwitch interfaces and limiting the ability to inject traffic through OVS userspace paths can reduce exposure. Upgrading to a patched kernel version is the recommended remediation (GitHub Advisory, Feedly).