Executive brief
Open vSwitch is a virtualization component of the Linux kernel that manages network traffic switching between virtual machines and containers. A use-after-free vulnerability in its flow deletion code can allow local attackers to trigger a kernel crash or potential code execution, disrupting virtual network infrastructure and impacting service availability for hosted applications.
Technical details
The vulnerability is a use-after-free condition in the Open vSwitch flow table management code (net/openvswitch). When a flow is deleted via netlink command CMD_DEL, the flow->mask structure is freed via RCU callback before the ovs_flow_cmd_fill_info() function accesses it. The code lacks a protective RCU read lock around the flow removal operation, creating a race window where the RCU grace period can pass between deletion and the subsequent info-filling operation. An attacker with capability to send netlink commands (typically root or CAP_NET_ADMIN) can trigger this race to cause a kernel panic via KASAN detection. The fix requires reordering the function calls so ovs_flow_cmd_fill_info() executes before ovs_flow_tbl_remove().
Affected products
- Linux Linux kernel latest versions (specific affected range not specified in advisory)
Timeline
- 2026-09-11: disclosed