Executive brief
A vulnerability in the Linux kernel's Open vSwitch component could cause a system to hang or become unresponsive when removing certain network tunnel ports. Open vSwitch is a widely used virtual switch that manages network traffic between virtual machines and physical networks. If exploited, this issue could lead to a denial-of-service condition, impacting the availability of networking services and the overall stability of the host system.
Technical details
A self-deadlock vulnerability exists in the Open vSwitch (OVS) vport implementation within the Linux kernel. The issue arises during the destruction of tunnel ports (ovs_netdev_tunnel_destroy) because the code incorrectly ordered the release of RCU-protected resources and the release of the Routing Netlink (RTNL) lock. Specifically, rtnl_unlock() triggers netdev_run_todo(), which blocks until all device references are released; however, the reference release was scheduled via call_rcu() only after the unlock, creating a circular dependency where the cleanup thread waits for a reference that cannot be released until the cleanup thread proceeds. This results in a deadlock during device removal. The fix involves moving the call_rcu() invocation before the rtnl_unlock() call to ensure the RCU callback can be executed during the synchronize_net() phase of the netdev todo list processing.
Affected products
- Linux Linux Kernel 6.1, 6.6, 6.8, 6.9
Timeline
- 2026-05-01: other: Patch authored
- 2026-05-28: advisory: CVE published
References
- https://git.kernel.org/stable/c/366c482965c673565ecb8bcfb15d5548f13a6a10
- https://git.kernel.org/stable/c/3df75fff46b1517eb479d8e6b8e3500763715dd0
- https://git.kernel.org/stable/c/6522d59fb7de55ce0f0f285d962243ddffebb01f
- https://git.kernel.org/stable/c/aa69918bd418e700309fdd08509dba324fb24296
- https://git.kernel.org/stable/c/c741433f6c8dcdecd1d9549d89053761fd1ea413