Junglewise Threat Intelligence

CVE-2026-45840: Linux Kernel Open vSwitch buffer overflow in vport netlink replies

CVE-2026-45840 · Severity: info · CVSS 6.2 · Published 2026-05-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Open vSwitch component could allow a local administrator to crash the entire system. Open vSwitch is a software-based network switch used extensively in virtualized environments and data centers to manage network traffic. By sending a specially crafted request to the system, an attacker can trigger a kernel panic, leading to a complete service outage and system instability.

Technical details

A vulnerability exists in the Open vSwitch (OVS) datapath implementation within the Linux kernel due to insufficient bounds checking in the 'ovs_vport_set_upcall_portids' function. The vport netlink reply helpers allocate a fixed-size socket buffer (skb) using 'nlmsg_new(NLMSG_DEFAULT_SIZE, ...)', but the 'ovs_vport_get_upcall_portids' function may attempt to serialize a PID array that exceeds this size. Because there was no upper bound on the PID array size, a user with CAP_NET_ADMIN privileges can install an array large enough to cause 'nla_put()' to fail with -EMSGSIZE, subsequently triggering a BUG_ON() and a kernel panic. This is notably exploitable from unprivileged user namespaces (e.g., on Ubuntu) where a user can gain CAP_NET_ADMIN within that namespace. The fix introduces a cap on the PID array size based on 'nr_cpu_ids' and ensures the reply buffer is pre-sized correctly.

Affected products

  • Linux Linux Kernel 7.0.0-rc7; fixed in 1d6c02b, 2091c6a, f99ac36, f9ef3db, fa6e90b

Timeline

  • 2026-04-15: patched: Initial patch authored by Weiming Shi
  • 2026-05-27: disclosed: CVE-2026-45840 published

References

Related threats