Executive brief
Open vSwitch (OVS), a virtual switch commonly used in cloud and SDN environments, contains a use-after-free vulnerability in its connection tracking (CT) limit handling. When a network namespace is torn down while packet processing is still in flight, freed memory can be dereferenced by active packet handlers, allowing an unprivileged user to crash the system or potentially execute code. This impacts availability and stability of virtualized network infrastructure.
Technical details
The vulnerability is a use-after-free in the Open vSwitch conntrack module (net/openvswitch/conntrack.c). Packet processing accesses CT limit state under RCU protection, but network namespace teardown freed that state under ovs_mutex without proper synchronization—the CT limit pointer was neither removed from readers nor protected by an RCU grace period. An unprivileged user can trigger this by creating a network namespace with OVS flows and tearing it down, causing the ovs_ct_execute() function to dereference freed memory (slab-use-after-free). The fix properly publishes the CT limit pointer through RCU, removes it before teardown, and waits for an RCU grace period between .pre_exit and .exit callbacks. No authentication is required; the trigger is local (namespace unprivileging).
Affected products
- Linux Linux kernel versions with CONFIG_NETFILTER_CONNCOUNT enabled (fix applies to linux-4.14.y through linux-7.2.y and later)
Timeline
- 2026-09-11: disclosed: Published to NVD
- 2026-09-14: patched: Fix merged into Linux stable trees via commit 239f26589a6926db28c436e14f28517581ef1385 and others