Executive brief
Open vSwitch is a software-based network switch used to manage virtual networks and packet forwarding in cloud and virtualization environments. A vulnerability in the kernel's Open vSwitch module allows an attacker to trigger a kernel panic by sending specially crafted network packets with insufficient Ethernet header data, causing service disruption and potential denial of service across affected systems.
Technical details
The vulnerability is a missing bounds check in the net/openvswitch/flow.c key_extract() function. When packets arrive on ARPHRD_NONE devices (e.g., TUN interfaces), the kernel trusts the user-supplied skb->protocol field without validating packet structure. If marked as ETH_P_TEB (Ethernet in Tunnel), the function unconditionally reads 14+ bytes for Ethernet headers without confirming the linear skb data is large enough, triggering a kernel BUG in __skb_pull(). An attacker with capability to send packets via TUN/TAP devices or inject crafted protocol headers can cause a kernel panic. The fix adds a check_header() validation call before accessing the Ethernet header data. Patch is available in Linux kernel stable branches.
Affected products
- Linux Linux kernel multiple versions (see kernel stable tree branches)
Timeline
- 2026-08-22: disclosed: CVE-2026-74701 published
- 2026-08-19: patched: Fix backported to stable kernel branches by Greg Kroah-Hartman