net: openvswitch: fix flow mask use-after-free on flow deletion
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix flow mask use-after-free on flow deletion The commit in the Fixes tag below made so flow->mask free is scheduled via RCU right after it is removed from the flow table. The pointer stays in the flow structure and it can be accessible while in the same RCU critical section. This is done to avoid requiring ovs_mutex for the ovs_flow_free(). However, while removing the flow during processing of CMD_DEL, we do not take RCU read lock before the removal, and ovs_flow_cmd_fill_info() uses the flow->mask pointer afterwards. The RCU read lock is taken, but it's already late at that point. The comment on that line acknowledges that the lock is cosmetic and doesn't serve a real purpose. This leads to use-after-free if the RCU grace period passes between removal and the filling. It is a short race window, but it is there and can lead to a real crash in case memory allocation for the info takes a bit longer: BUG: KASAN: slab-use-after-free in __ovs_nla_put_key net/openvswitch/flow_netlink.c:1996 BUG: KASAN: slab-use-after-free in ovs_nla_put_key+0x2463/0x2e30 net/openvswitch/flow_netlink.c:2250 Read of size 4 at addr ffff88801ee89970 by task ovs_flow_del_ec/9487 Call Trace: __ovs_nla_put_key net/openvswitch/flow_netlink.c:1996 ovs_nla_put_key+0x2463/0x2e30 net/openvswitch/flow_netlink.c:2250 ovs_flow_cmd_fill_info+0x420/0x9c0 net/openvswitch/datapath.c:930 ovs_flow_cmd_del+0x53a/0x970 net/openvswitch/
CVE-2026-80994
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-80994
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "56c19868e115fcf8d62d843e1b9616bb9837d0db",
"lessThan": "ea5f7b45b582665541ddfb77dce98611354af4ab",
"versionType": "git"
},
{
"status": "affected",
"version": "56c19868e115fcf8d62d843e1b9616bb9837d0db",
"lessThan": "18ce1a8b7499c016d4a893d9b1db80608f73745d",
"versionType": "git"
},
{
"status": "affected",
"version": "56c19868e115fcf8d62d843e1b9616bb9837d0db",
"lessThan": "c15ef9a5bf594f93a31de2ec2ec394e2a903519a",
"versionType": "git"
},
{
"status": "affected",
"version": "56c19868e115fcf8d62d843e1b9616bb9837d0db",
"lessThan": "64051fe200c7c759af71634bd2123552eaabb69a",
"versionType": "git"
},
{
"status": "affected",
"version": "56c19868e115fcf8d62d843e1b9616bb9837d0db",
"lessThan": "0ba5cbc2f049af94ec94ff6f64958545efc5eaa2",
"versionType": "git"
},
{
"status": "affected",
"version": "56c19868e115fcf8d62d843e1b9616bb9837d0db",
"lessThan": "ac73e3af571da06c1d1cfe3f0f00dc978b851700",
"versionType": "git"
},
{
"status": "affected",
"version": "56c19868e115fcf8d62d843e1b9616bb9837d0db",
"lessThan": "7f072b84afd05a77963eb1872f7174e280661dce",
"versionType": "git"
},
{
"status": "affected",
"version": "56c19868e115fcf8d62d843e1b9616bb9837d0db",
"lessThan": "4e30317ff67a2eb12b4d890d39f72fd7e7117d48",
"versionType": "git"
}
],
"programFiles": [
"net/openvswitch/datapath.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.16",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/openvswitch/datapath.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-80994
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #34950 · Revision 1
- Added to Heist Feed
- Publisher date