Linux Kernel Patches Zerocopy Network Vulnerability Affecting Open vSwitch

On September 11, 2026, Linux kernel maintainers disclosed and resolved CVE-2026-80977, a high-severity race condition in the operating system's core networking stack. The vulnerability, which carries a Common Vulnerability Scoring System (CVSS) base score of 7.4 out of 10.0, stemmed from how the kernel manages memory during high-speed zero-copy network transmissions. Rather than a catastrophic architectural failure, the flaw represented a highly specific synchronization error in socket buffer cloning—a mechanism used heavily by virtualized network infrastructure like Open vSwitch to route packets across 10-gigabit and 100-gigabit interfaces.[2][5][6]

The issue originated in the skb_tx_error() function, which handles errors during packet transmission. In modern Linux networking, to optimize performance, the kernel avoids copying data between memory spaces whenever possible, using a "zero-copy" approach. When a packet needs to be duplicated—for instance, when Open vSwitch recirculates a flow using the OVS_ACTION_ATTR_RECIRC command—the kernel creates a "clone" of the socket buffer (skb) that shares the underlying data payload with the original buffer.[4][5][6]

The vulnerability was triggered when an error occurred on one of these cloned packets while the original was still in flight. The skb_tx_error() function would clear shared zerocopy state flags, prematurely signaling to the producer that the memory pages were free. Because the cloned buffer and the original buffer shared the exact same metadata structure (skb_shinfo), this action inadvertently stripped critical markers from the original packet that was still being actively forwarded.[2][4][5]

This premature release created a classic use-after-free scenario, tracked under the Common Weakness Enumeration identifier CWE-416. If a subsequent local Encapsulating Security Payload (ESP) delivery attempted to decrypt the packet, it would do so in place over memory fragments it no longer exclusively owned. While VulDB analysts noted that remote exploitation was theoretically possible, no active exploits have been observed in the wild, and the complexity of aligning the race condition makes reliable weaponization difficult.[2][4][5]

The resolution merged into the kernel tree is remarkably straightforward: the networking subsystem now simply skips this zerocopy state modification for cloned socket buffers. "Nothing is lost: skb_release_data() clears the zerocopy state once the last reference to the shared data goes," the kernel commit documentation explains. By deferring the cleanup, the kernel ensures the shared state remains intact until all clones are processed.[5][6]

The patch has been backported to stable kernel branches, including versions 6.12.109, 6.18.50, and 7.2.4, effectively closing the window for potential denial-of-service attacks against virtualized routing environments. For enterprise users, the immediate risk appears minimal. "Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product," the company stated in its Bugzilla tracker on September 11. For infrastructure operators, the incident highlights the inherent tension between aggressive memory optimization and thread safety in concurrent network processing.[2][4][6]

The rapid identification and patching of this vulnerability underscore the maturity of the Linux kernel's security apparatus. By addressing the root cause within the socket buffer lifecycle rather than disabling zero-copy features entirely, the maintainers preserved the high-throughput capabilities that modern cloud environments demand.[6]

Moving forward, network administrators running custom or out-of-tree kernel modules that interact heavily with Open vSwitch are advised to verify their patch levels. While mainstream distributions have already absorbed the fix, edge deployments utilizing older, unpatched kernels remain theoretically exposed to the race condition.[1][3][6]