Junglewise Threat Intelligence

CVE-2025-40254: Linux Kernel Open vSwitch NULL pointer dereference in NSH validation

CVE-2025-40254 · Severity: info · CVSS 6.2 · Published 2025-12-04

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Open vSwitch component could allow an attacker to crash the system. Open vSwitch is a virtual switch used in cloud and data center environments to manage network traffic between virtual machines. By sending specifically crafted network configuration commands, an attacker can trigger a kernel crash, leading to a complete service outage.

Technical details

A vulnerability exists in the Open vSwitch (OVS) module of the Linux kernel due to improper validation of the 'set(nsh(...))' action. The root cause is a mismatch in memory layout expectations within the nsh_key_put_from_nlattr() function when processing masked set actions. Specifically, nested attributes are doubled in size for masked sets, but the validation logic fails to account for this, leading to a NULL pointer dereference when the kernel attempts to write to unallocated memory via SW_FLOW_KEY_PUT(). Because the feature was found to be fundamentally broken since its introduction, the fix involves the complete removal of NSH field-setting support in OVS. The vulnerability can be triggered via Netlink messages, potentially by a local user with network administrative privileges or through processed network packets depending on the OVS configuration.

Affected products

  • Linux Linux Kernel Introduced in b2d0f5d5dc53 (v4.14) and fixed in various stable branches

Timeline

  • 2025-11-12: patched: Initial patch submitted to kernel mailing list
  • 2025-12-04: disclosed: CVE-2025-40254 assigned and published

References