All vulnerabilities
CVE-2026-97611

Linux: net: openvswitch: fix use-after-free of the flow table mask array

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4c98b492e9ed63f9ca3e23566d9a6a4f235944f4Also 4016ead17acd75312c066ecd47c4b7f0a81ceaa2, 017dbbf0d6c319a487f68e22f56d91fc787d5525 and 2 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 4c98b492e9ed63f9ca3e23566d9a6a4f235944f4LinuxCVE List
  • 4016ead17acd75312c066ecd47c4b7f0a81ceaa2LinuxCVE List
  • 017dbbf0d6c319a487f68e22f56d91fc787d5525LinuxCVE List
  • 76678217cdabc41e3c74c23b45b62086ffb8fe7aLinuxCVE List
  • 035e9c3722067648a99010711d0ce81f42572ef4LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix use-after-free of the flow table mask array

tbl_mask_array_realloc() retires the old mask_array before it stops being reachable:

old = ovsl_dereference(tbl->mask_array); if (old) { ... call_rcu(&old->rcu, mask_array_rcu_cb); }

rcu_assign_pointer(tbl->mask_array, new);

call_rcu() only waits for read-side critical sections already in flight. tbl->mask_array still points at old between the call_rcu() and the rcu_assign_pointer(), so a reader entering ovs_flow_tbl_lookup_stats() in that window picks up old in a fresh critical section that the pending grace period does not cover.

tbl_mask_array_realloc() runs in process context under ovs_mutex, so the window is preemptible and can outlast the grace period. Then mask_array_rcu_cb() frees old before the swap runs:

BUG: KASAN: slab-use-after-free in flow_lookup.constprop.0+0x2bf/0x2f0 Read of size 8 at addr ffff888020b3e018 by task poc/741 flow_lookup.constprop.0+0x2bf/0x2f0 ovs_flow_tbl_lookup_stats+0x4a3/0x5c0 ovs_dp_process_packet+0x19c/0x710 ovs_vport_receive+0x243/0x390 internal_dev_xmit+0x81/0x170 Freed by task 728: kfree+0x16a/0x4e0 rcu_core+0x853/0x1030

Publish the new array before retiring the old one. The kfree_rcu() that call_rcu() replaced ran after the swap.

Text from CVE List

Affected versions 18

  • Linuxaffected: eac87c413bf9794c14d488998a5265ea5b32f04e before 4c98b492e9ed63f9ca3e23566d9a6a4f235944f4CVE List
  • Linuxaffected: eac87c413bf9794c14d488998a5265ea5b32f04e before 4016ead17acd75312c066ecd47c4b7f0a81ceaa2CVE List
  • Linuxaffected: eac87c413bf9794c14d488998a5265ea5b32f04e before 017dbbf0d6c319a487f68e22f56d91fc787d5525CVE List
  • Linuxaffected: eac87c413bf9794c14d488998a5265ea5b32f04e before 76678217cdabc41e3c74c23b45b62086ffb8fe7aCVE List
  • Linuxaffected: eac87c413bf9794c14d488998a5265ea5b32f04e before cd982e11684def5d4a9fcfd5354de09032828414CVE List
  • Linuxaffected: eac87c413bf9794c14d488998a5265ea5b32f04e before a0d18d21d48a551f82ee344e50efb8a682161489CVE List
  • Linuxaffected: eac87c413bf9794c14d488998a5265ea5b32f04e before 035e9c3722067648a99010711d0ce81f42572ef4CVE List
  • Linuxaffected: eac87c413bf9794c14d488998a5265ea5b32f04e before ba4ba11ed6eb8972c69070417fc27b48deb002e8CVE List
  • Linuxaffected: 5.9CVE List
  • Linuxunaffected: all versions before 5.9CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8