Executive brief
A vulnerability exists in the Linux kernel's Open vSwitch component, which is used for managing virtual network traffic. Under specific conditions, particularly on systems using real-time (RT) kernel configurations, the system may prematurely delete network device information while it is still being processed. This can lead to a system crash (General Protection Fault), potentially impacting the availability of the server or industrial control equipment like Siemens SIMATIC CPUs.
Technical details
A race condition exists in net/openvswitch/vport-netdev.c due to improper synchronization during port teardown. The vulnerability occurs because the IFF_OVS_DATAPATH flag is cleared before unregistration is complete, allowing netdev_destroy() to proceed to call_rcu() and free the device prematurely if the process is preempted (common in PREEMPT_RT kernels). This results in a General Protection Fault when the kernel attempts to access the freed netdev during the remainder of the unregistration process. The fix involves reordering operations in ovs_netdev_detach_dev() and implementing memory barriers (smp_wmb/smp_mb) to ensure unregistration completes before the device is freed.
Affected products
- Linux Linux Kernel 6.12.0-211.1.1.el10_2.x86_64+rt and other versions using Open vSwitch
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2026-03-18: patched: Initial patch proposed by Toke Høiland-Jørgensen
- 2026-04-22: advisory: CVE published to NVD
References
- https://git.kernel.org/stable/c/33609454be4f582e686a4bf13d4482a5ca0f6c4b
- https://git.kernel.org/stable/c/43579baa17270aa51f93eb09b6e4af6e047b7f6e
- https://git.kernel.org/stable/c/4c3e25a7b711a402fcbbbcfbbdf2868ece1ae7c8
- https://git.kernel.org/stable/c/5fdeaf591a0942772c2d18ff3563697a49ad01c6
- https://git.kernel.org/stable/c/755a6300afbd743cda4b102f24f343380ec0e0ff
- https://git.kernel.org/stable/c/7c770dadfda5cbbde6aa3c4363ed513f1d212bf8
- https://git.kernel.org/stable/c/95265232b49765a4d00f4d028c100bb7185600f4