UBUNTU-CVE-2026-89487: High severity ubuntu/linux vulnerability

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror() a packet we are about to drop queueuserspacepacket() borrows the packet skb -- it only copies it into a private netlink message (userskb) and does not own it; on return doexecuteactions() keeps forwarding it through the flow's remaining actions. Its error path nevertheless calls skbtxerror(skb), which via skbzcopyclear() does skbshinfo(skb)->flags &= ~SKBFLALLZEROCOPY, stripping SKBFLSHAREDFRAG from that live skb (skbtxerror()'s kerneldoc says "skb must be freed afterwards"). For a MSGZEROCOPY skb carrying page-cache frags, SKBFLSHAREDFRAG is what makes espinput() skbcowdata() before in-place AEAD; once it is stripped a later local ESP-in-UDP delivery decrypts in place over pages the sender does not own -- an unprivileged page-cache write (the "Fragnesia" primitive). doexecuteactions() ignores outputuserspace()'s return value, so any action after a failed USERSPACE upcall inherits the stripped skb. Move the skbtxerror() to the flow-miss drop path - the "default" branch of ovsdpprocesspacket()'s switch(error), before kfreeskb(). The call has been here since commit 36d5fe6a0007 ("core, nfqueue, openvswitch: Orphan frags in skbzerocopy and handle errors") but was harmless until espinput() began relying on SKBFLSHAREDFRAG to gate in-place decrypt; only then did stripping it on a still-forwarded skb become a page-cache write primitive.