{"id":21310,"date":"2026-09-12T04:31:01","date_gmt":"2026-09-11T20:31:01","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80977"},"modified":"2026-09-12T04:31:01","modified_gmt":"2026-09-11T20:31:01","slug":"cve-2026-80977","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80977","title":{"rendered":"CVE-2026-80977 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don&#8217;t to"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: skbuff: don&#8217;t touch shared zerocopy state in skb_tx_error()<\/p>\n<p>skb_tx_error() completes the zerocopy uarg and clears<br \/>\nSKBFL_ALL_ZEROCOPY, and skb_zcopy_downgrade_managed() clears<br \/>\nSKBFL_MANAGED_FRAG_REFS. Both live in skb_shinfo(), which every clone<br \/>\nshares, while the caller only owns the reference it is about to drop.<br \/>\nThrough a clone it tells the producer its pages are free and drops<br \/>\nSKBFL_SHARED_FRAG for an skb that is still in flight.<\/p>\n<p>Open vSwitch reaches this with a non-last OVS_ACTION_ATTR_RECIRC:<br \/>\nclone_execute() sends a skb_clone() into ovs_dp_process_packet() while<br \/>\ndo_execute_actions() keeps forwarding the original, and skb_clone()<br \/>\ndoes not privatise the frags here &#8212; skb_orphan_frags() returns early<br \/>\non SKBFL_DONT_ORPHAN. A flow miss on the clone then strips the marker<br \/>\nfrom the packet still being forwarded, and a later local ESP delivery<br \/>\ndecrypts in place over frags it does not own privately.<\/p>\n<p>Skip it for a cloned skb. Nothing is lost: skb_release_data() clears<br \/>\nthe zerocopy state once the last reference to the shared data goes.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: skbuff: don&#8217;t touch shared zerocopy state in skb_tx_error()<\/p>\n<p>skb_tx_error() completes the zerocopy uarg and clears<br \/>\nSKBFL_ALL_Z<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21310","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21310","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21310"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}