SB20260912389 - Use-after-free in Linux kernel core

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-80977)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt memory.

The vulnerability exists due to improper handling of shared zerocopy state in skb_tx_error() when processing cloned socket buffers. A remote attacker can trigger processing of cloned socket buffers to corrupt memory.

The issue can be reached when Open vSwitch processes a non-last OVS_ACTION_ATTR_RECIRC action, the clone encounters a flow miss, and a later local ESP delivery decrypts data in place.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0370da114a9bc044e248b85c6809d1b5e0c1f7f9
• https://git.kernel.org/stable/c/15aa81b390d401abf4b8211042470e9e92e3b7fb
• https://git.kernel.org/stable/c/288f9970670841044ab030104fa6b6ed159949d0
• https://git.kernel.org/stable/c/f66bdb1cc0fcd227a062378f8be0b5873aa5600a