Open vSwitch strips SKBFL_SHARED_FRAG — Dirty COW-class decrypt write (CVE-2026-90049/89487/80977)
Doyensec research post (17 September 2026) shows Open vSwitch’s kernel datapath can strip SKBFL_SHARED_FRAG from a still-forwarded packet, re-opening the Fragnesia Dirty COW-class primitive: an unprivileged user can cause in-place ESP decrypt over page-cache pages they may only read, writing attacker-chosen bytes into root-owned file page cache.
Tracked as CVE-2026-90049, CVE-2026-89487 and CVE-2026-80977; reported to the Linux kernel security team and coordinated with OVS maintainers. Builds on prior Dirty Frag / Fragnesia work (including CVE-2026-43284 and CVE-2026-43500). Impact surface: virtualisation/container stacks using OVS (OpenStack Neutron, oVirt, Antrea/OVN-Kubernetes, libvirt bridges, etc.). (source: Doyensec blog)
Correction (02 Nov 2026): removed talkback.sh as a source. (source: Doyensec)
- Product
- Open vSwitch kernel datapath (openvswitch.ko) / Linux networking
- Versions
- Affected OVS/kernel builds prior to coordinated fixes for CVE-2026-90049 / CVE-2026-89487 / CVE-2026-80977 (exact package versions per distro advisory)
- Exploited in Australia?
- unknown
- Patch to
- Apply vendor/distro kernel and openvswitch updates once published for CVE-2026-90049/89487/80977; until then restrict untrusted local users on OVS hosts and monitor kernel security ML