Executive brief
Open vSwitch is a network virtualization technology embedded in the Linux kernel that manages virtual network switches and flow rules. A buffer overflow can occur when updating flow rules with mismatched identifiers, allowing a local attacker with network access to the Open vSwitch daemon to trigger a kernel crash. This could disrupt virtual network operations and service availability.
Technical details
The vulnerability exists in the openvswitch datapath component (net/openvswitch/datapath.c) within the ovs_flow_cmd_new() function. The function preallocates a reply socket buffer (skb) before determining which existing flow will be updated. When a flow update request uses a User-space Flow IDentifier (UFID) that misses during lookup and falls back to a flow key lookup, the matched flow's identifier may be larger than the request UFID, leaving insufficient buffer space. When ovs_flow_cmd_fill_info() writes the matched flow's identifier instead of the request identifier, the buffer can overflow with -EMSGSIZE, hitting a BUG_ON() assertion in the update path. The fix reallocates the reply buffer after the update target is resolved and before action replacement, allowing the request to fail cleanly if the extra allocation fails. Attack requires ability to send crafted netlink flow update commands to the kernel.
Affected products
- Linux Linux kernel Multiple versions affecting openvswitch datapath component
Timeline
- 2026-08-22: disclosed
- 2026-08-19: patched: Patch committed to stable kernel by Greg Kroah-Hartman