GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89487 (GCVE-0-2026-89487)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:43 – Updated: 2026-09-14 12:00
VLAI
Title
openvswitch: only skb_tx_error() a packet we are about to drop
Summary
In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skb_tx_error() a packet we are about to drop queue_userspace_packet() borrows the packet skb -- it only copies it into a private netlink message (user_skb) and does not own it; on return do_execute_actions() keeps forwarding it through the flow's remaining actions. Its error path nevertheless calls skb_tx_error(skb), which via skb_zcopy_clear() does skb_shinfo(skb)->flags &= ~SKBFL_ALL_ZEROCOPY, stripping SKBFL_SHARED_FRAG from that live skb (skb_tx_error()'s kerneldoc says "skb must be freed afterwards"). For a MSG_ZEROCOPY skb carrying page-cache frags, SKBFL_SHARED_FRAG is what makes esp_input() skb_cow_data() before in-place AEAD; once it is stripped a later local ESP-in-UDP delivery decrypts in place over pages the sender does not own -- an unprivileged page-cache write (the "Fragnesia" primitive). do_execute_actions() ignores output_userspace()'s return value, so any action after a failed USERSPACE upcall inherits the stripped skb. Move the skb_tx_error() to the flow-miss drop path - the "default" branch of ovs_dp_process_packet()'s switch(error), before kfree_skb(). The call has been here since commit 36d5fe6a0007 ("core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors") but was harmless until esp_input() began relying on SKBFL_SHARED_FRAG to gate in-place decrypt; only then did stripping it on a still-forwarded skb become a page-cache write primitive.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 36d5fe6a000790f56039afe26834265db0a3ad4c , < 5de5d554141a15b3f1f5c978fd9f7f4fd6d0600a (git)
Affected: 36d5fe6a000790f56039afe26834265db0a3ad4c , < 48db11e115d1b232edc5591604adc6eda95cd545 (git)
Affected: 36d5fe6a000790f56039afe26834265db0a3ad4c , < 4477222e2916a18e273edc139c955ade6bbb7a69 (git)
Affected: 36d5fe6a000790f56039afe26834265db0a3ad4c , < 4d5c460ef8754be1d43b16dbf02695b008b207d6 (git)
Affected: 36d5fe6a000790f56039afe26834265db0a3ad4c , < 6767d70cf46f65807a6a4c4406a518e6c12e36ae (git)
Affected: 36d5fe6a000790f56039afe26834265db0a3ad4c , < e41a59fc056f63a7a1f42788913c53cc48d744aa (git)
Affected: 36d5fe6a000790f56039afe26834265db0a3ad4c , < 5d85eef222cfd28e73deed7402c100229e8b9e6e (git)
Affected: 36d5fe6a000790f56039afe26834265db0a3ad4c , < 0dbc2398fca3bb33eda963849f865ddb1b3aa05e (git)
Affected: c5f0c0e7525443add533495e93ba8de6feab2396 (git)
Affected: 1674b4bf3eea3cac51b70778e89f8025f7cfe695 (git)
Affected: 3.10.51 , < 3.11 (semver)
Affected: 3.12.40 , < 3.13 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 3.14
Unaffected: 0 , < 3.14 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/datapath.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5de5d554141a15b3f1f5c978fd9f7f4fd6d0600a",
              "status": "affected",
              "version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
              "versionType": "git"
            },
            {
              "lessThan": "48db11e115d1b232edc5591604adc6eda95cd545",
              "status": "affected",
              "version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
              "versionType": "git"
            },
            {
              "lessThan": "4477222e2916a18e273edc139c955ade6bbb7a69",
              "status": "affected",
              "version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
              "versionType": "git"
            },
            {
              "lessThan": "4d5c460ef8754be1d43b16dbf02695b008b207d6",
              "status": "affected",
              "version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
              "versionType": "git"
            },
            {
              "lessThan": "6767d70cf46f65807a6a4c4406a518e6c12e36ae",
              "status": "affected",
              "version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
              "versionType": "git"
            },
            {
              "lessThan": "e41a59fc056f63a7a1f42788913c53cc48d744aa",
              "status": "affected",
              "version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
              "versionType": "git"
            },
            {
              "lessThan": "5d85eef222cfd28e73deed7402c100229e8b9e6e",
              "status": "affected",
              "version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
              "versionType": "git"
            },
            {
              "lessThan": "0dbc2398fca3bb33eda963849f865ddb1b3aa05e",
              "status": "affected",
              "version": "36d5fe6a000790f56039afe26834265db0a3ad4c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c5f0c0e7525443add533495e93ba8de6feab2396",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1674b4bf3eea3cac51b70778e89f8025f7cfe695",
              "versionType": "git"
            },
            {
              "lessThan": "3.11",
              "status": "affected",
              "version": "3.10.51",
              "versionType": "semver"
            },
            {
              "lessThan": "3.13",
              "status": "affected",
              "version": "3.12.40",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/datapath.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.14"
            },
            {
              "lessThan": "3.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.10.51",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.12.40",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: only skb_tx_error() a packet we are about to drop\n\nqueue_userspace_packet() borrows the packet skb -- it only copies it into\na private netlink message (user_skb) and does not own it; on return\ndo_execute_actions() keeps forwarding it through the flow\u0027s remaining\nactions. Its error path nevertheless calls skb_tx_error(skb), which via\nskb_zcopy_clear() does skb_shinfo(skb)-\u003eflags \u0026= ~SKBFL_ALL_ZEROCOPY,\nstripping SKBFL_SHARED_FRAG from that live skb (skb_tx_error()\u0027s kerneldoc\nsays \"skb must be freed afterwards\").\n\nFor a MSG_ZEROCOPY skb carrying page-cache frags, SKBFL_SHARED_FRAG is\nwhat makes esp_input() skb_cow_data() before in-place AEAD; once it is\nstripped a later local ESP-in-UDP delivery decrypts in place over pages\nthe sender does not own -- an unprivileged page-cache write (the\n\"Fragnesia\" primitive).\ndo_execute_actions() ignores output_userspace()\u0027s return value, so any\naction after a failed USERSPACE upcall inherits the stripped skb.\n\nMove the skb_tx_error() to the flow-miss drop path - the \"default\"\nbranch of ovs_dp_process_packet()\u0027s switch(error), before kfree_skb().\n\nThe call has been here since commit 36d5fe6a0007 (\"core, nfqueue,\nopenvswitch: Orphan frags in skb_zerocopy and handle errors\") but was\nharmless until esp_input() began relying on SKBFL_SHARED_FRAG to gate\nin-place decrypt; only then did stripping it on a still-forwarded skb\nbecome a page-cache write primitive."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The strip runs only on a locally originated MSG_ZEROCOPY skb that still has a zerocopy uarg (skb_zcopy_clear is a no-op otherwise); NIC-received packets never carry that uarg, and the later in-place ESP decrypt is via a local SA, so a local account is required.\nAC:L - The attacker fully controls the OVS flow (non-last USERSPACE with a PID that makes genlmsg_unicast fail), the MSG_ZEROCOPY send, and the ESP SA/payload; do_execute_actions() ignores the upcall error, so the shared-frag strip and in-place decrypt are deterministic with no race beyond attacker influence.\nPR:L - OVS genetlink families are netnsok and use GENL_UNS_ADMIN_PERM (CAP_NET_ADMIN in the socket user_ns); an unprivileged user can unshare -Urn, create a datapath/flow, enable SO_ZEROCOPY, and install xfrm SAs, while the global page cache remains the corruption target.\nUI:N - The attacker installs the OVS userspace-then-output flow, sends the MSG_ZEROCOPY packet, and completes local ESP-in-UDP delivery without any victim action such as opening a file or mounting a filesystem.\nS:U - The resulting page-cache write is a standard in-kernel memory-corruption/privilege-escalation primitive on the same host; it does not cross a VM hypervisor or IOMMU security boundary.\nC:H - Clearing SKBFL_SHARED_FRAG lets later esp_input() skip skb_cow_data() and AEAD-decrypt in place over page-cache-backed frags, a write primitive into globally cached file/code pages that can be leveraged for arbitrary disclosure.\nI:H - With the shared-frag marker stripped, ESP decrypts attacker-controlled plaintext in place over page-cache pages the sender does not own, yielding the Fragnesia unprivileged write into files the attacker could only read.\nA:H - In-place writes into page-cache-backed or still-mapped zerocopy pages corrupt shared kernel/file state and readily cause oopses, panics, and process crashes; skb_tx_error also completes the uarg while the skb is still in flight."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:00:22.434Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5de5d554141a15b3f1f5c978fd9f7f4fd6d0600a"
        },
        {
          "url": "https://git.kernel.org/stable/c/48db11e115d1b232edc5591604adc6eda95cd545"
        },
        {
          "url": "https://git.kernel.org/stable/c/4477222e2916a18e273edc139c955ade6bbb7a69"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d5c460ef8754be1d43b16dbf02695b008b207d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/6767d70cf46f65807a6a4c4406a518e6c12e36ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/e41a59fc056f63a7a1f42788913c53cc48d744aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d85eef222cfd28e73deed7402c100229e8b9e6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0dbc2398fca3bb33eda963849f865ddb1b3aa05e"
        }
      ],
      "title": "openvswitch: only skb_tx_error() a packet we are about to drop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89487",
    "datePublished": "2026-09-11T19:43:40.776Z",
    "dateReserved": "2026-09-11T19:38:34.713Z",
    "dateUpdated": "2026-09-14T12:00:22.434Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89487",
      "date": "2026-09-16",
      "epss": "0.00129",
      "percentile": "0.02907"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:57:33.000Z",
      "cve": "CVE-2026-89487",
      "id": "msrc_CVE-2026-89487",
      "initial_release_date": "2026-09-13T01:10:34.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "openvswitch: only skb_tx_error() a packet we are about to drop",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89487.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89487\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:30.413\",\"lastModified\":\"2026-09-14T13:19:05.460\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nopenvswitch: only skb_tx_error() a packet we are about to drop\\n\\nqueue_userspace_packet() borrows the packet skb -- it only copies it into\\na private netlink message (user_skb) and does not own it; on return\\ndo_execute_actions() keeps forwarding it through the flow\u0027s remaining\\nactions. Its error path nevertheless calls skb_tx_error(skb), which via\\nskb_zcopy_clear() does skb_shinfo(skb)-\u003eflags \u0026= ~SKBFL_ALL_ZEROCOPY,\\nstripping SKBFL_SHARED_FRAG from that live skb (skb_tx_error()\u0027s kerneldoc\\nsays \\\"skb must be freed afterwards\\\").\\n\\nFor a MSG_ZEROCOPY skb carrying page-cache frags, SKBFL_SHARED_FRAG is\\nwhat makes esp_input() skb_cow_data() before in-place AEAD; once it is\\nstripped a later local ESP-in-UDP delivery decrypts in place over pages\\nthe sender does not own -- an unprivileged page-cache write (the\\n\\\"Fragnesia\\\" primitive).\\ndo_execute_actions() ignores output_userspace()\u0027s return value, so any\\naction after a failed USERSPACE upcall inherits the stripped skb.\\n\\nMove the skb_tx_error() to the flow-miss drop path - the \\\"default\\\"\\nbranch of ovs_dp_process_packet()\u0027s switch(error), before kfree_skb().\\n\\nThe call has been here since commit 36d5fe6a0007 (\\\"core, nfqueue,\\nopenvswitch: Orphan frags in skb_zerocopy and handle errors\\\") but was\\nharmless until esp_input() began relying on SKBFL_SHARED_FRAG to gate\\nin-place decrypt; only then did stripping it on a still-forwarded skb\\nbecome a page-cache write primitive.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/openvswitch/datapath.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"36d5fe6a000790f56039afe26834265db0a3ad4c\",\"lessThan\":\"5de5d554141a15b3f1f5c978fd9f7f4fd6d0600a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"36d5fe6a000790f56039afe26834265db0a3ad4c\",\"lessThan\":\"48db11e115d1b232edc5591604adc6eda95cd545\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"36d5fe6a000790f56039afe26834265db0a3ad4c\",\"lessThan\":\"4477222e2916a18e273edc139c955ade6bbb7a69\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"36d5fe6a000790f56039afe26834265db0a3ad4c\",\"lessThan\":\"4d5c460ef8754be1d43b16dbf02695b008b207d6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"36d5fe6a000790f56039afe26834265db0a3ad4c\",\"lessThan\":\"6767d70cf46f65807a6a4c4406a518e6c12e36ae\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"36d5fe6a000790f56039afe26834265db0a3ad4c\",\"lessThan\":\"e41a59fc056f63a7a1f42788913c53cc48d744aa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"36d5fe6a000790f56039afe26834265db0a3ad4c\",\"lessThan\":\"5d85eef222cfd28e73deed7402c100229e8b9e6e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"36d5fe6a000790f56039afe26834265db0a3ad4c\",\"lessThan\":\"0dbc2398fca3bb33eda963849f865ddb1b3aa05e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c5f0c0e7525443add533495e93ba8de6feab2396\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1674b4bf3eea3cac51b70778e89f8025f7cfe695\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3.10.51\",\"lessThan\":\"3.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.12.40\",\"lessThan\":\"3.13\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/openvswitch/datapath.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0dbc2398fca3bb33eda963849f865ddb1b3aa05e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4477222e2916a18e273edc139c955ade6bbb7a69\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/48db11e115d1b232edc5591604adc6eda95cd545\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4d5c460ef8754be1d43b16dbf02695b008b207d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5d85eef222cfd28e73deed7402c100229e8b9e6e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5de5d554141a15b3f1f5c978fd9f7f4fd6d0600a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6767d70cf46f65807a6a4c4406a518e6c12e36ae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e41a59fc056f63a7a1f42788913c53cc48d744aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-15T08:13:00+00:00",
      "cve": "CVE-2026-89487",
      "id": "CVE-2026-89487",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "262",
      "product_status:under_investigation": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: openvswitch: only skb_tx_error() a packet we are about to drop",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89487.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:03:03Z",
      "cve": "CVE-2026-89487",
      "id": "CVE-2026-89487",
      "initial_release_date": "2026-09-12T16:27:36Z",
      "product_status:known_affected": "349",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89487",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89487.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.