Executive brief
A vulnerability was identified in the Linux kernel's Open vSwitch component, which is used for virtual networking. Under specific error conditions during network buffer allocation, the system may attempt to release an invalid memory pointer, potentially leading to a system crash or instability. This issue primarily affects the reliability and availability of the host system.
Technical details
A vulnerability in 'net/openvswitch/datapath.c' within the Linux kernel arises from an incorrect error-handling sequence in 'ovs_flow_cmd_set'. When the allocation of a 'reply' socket buffer (skb) fails after the 'ovs_mutex' has been locked, the 'reply' variable is populated with an ERR_PTR. The subsequent cleanup routine attempts to call 'kfree_skb' on this invalid pointer instead of NULL, leading to a kernel oops or panic. This is a classic error-path bug where the cleanup order does not match the allocation order introduced in a previous refactoring. The fix ensures the pointer is set to NULL after capturing the error code, preventing the invalid free.
Affected products
- Linux Linux Kernel 3.16 to 5.10.259, 5.15.161, 6.1.94, 6.6.34, 6.9.5, 6.10-rc3
Timeline
- 2026-06-04: disclosed: Patch submitted by Adrian Moreno
- 2026-06-19: patched: Commits merged into stable branches
- 2026-06-25: advisory: CVE published and NVD record created
References
- https://git.kernel.org/stable/c/0bb5b2dc1b90aa7dd1473fc8c4d813a29255ff8d
- https://git.kernel.org/stable/c/25fdf53698535fe8790237f5a8a9626791429785
- https://git.kernel.org/stable/c/895d1dd9057cde1687fa0f4286d47ceed0b82997
- https://git.kernel.org/stable/c/971b1b37774f13acc5add0a2843f8598446b8598
- https://git.kernel.org/stable/c/e248fb2e680deb2bd37bac551b72638fe4938a76
- https://git.kernel.org/stable/c/e3d509a1b71396e1452060dbf84a805fd1c3c549
- https://git.kernel.org/stable/c/ecc55aad3390129a87106841f4b68bf3d70c9264