net: openvswitch: Avoid releasing netdev before teardown completes
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Avoid releasing netdev before teardown completes The patch cited in the Fixes tag below changed the teardown code for OVS ports to no longer unconditionally take the RTNL. After this change, the netdev_destroy() callback can proceed immediately to the call_rcu() invocation if the IFF_OVS_DATAPATH flag is already cleared on the netdev. The ovs_netdev_detach_dev() function clears the flag before completing the unregistration, and if it gets preempted after clearing the flag (as can happen on an -rt kernel), netdev_destroy() can complete and the device can be freed before the unregistration completes. This leads to a splat like: [ 998.393867] Oops: general protection fault, probably for non-canonical address 0xff00000001000239: 0000 [#1] SMP PTI [ 998.393877] CPU: 42 UID: 0 PID: 55177 Comm: ip Kdump: loaded Not tainted 6.12.0-211.1.1.el10_2.x86_64+rt #1 PREEMPT_RT [ 998.393886] Hardware name: Dell Inc. PowerEdge R740/0JMK61, BIOS 2.24.0 03/27/2025 [ 998.393889] RIP: 0010:dev_set_promiscuity+0x8d/0xa0 [ 998.393901] Code: 00 00 75 d8 48 8b 53 08 48 83 ba b0 02 00 00 00 75 ca 48 83 c4 08 5b c3 cc cc cc cc 48 83 bf 48 09 00 00 00 75 91 48 8b 47 08 <48> 83 b8 b0 02 00 00 00 74 97 eb 81 0f 1f 80 00 00 00 00 90 90 90 [ 998.393906] RSP: 0018:ffffce5864a5f6a0 EFLAGS: 00010246 [ 998.393912] RAX: ff00000000ffff89 RBX: ffff894d0adf5a05 RCX: 0000000000000000 [ 998.393917] RDX: 0000000000000000 RSI: 00000000
CVE-2026-31508
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-31508
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "b823c3344d5446b720227ba561df10a4f0add515",
"lessThan": "df3c95be76103604e752131d9495a24814915ece",
"versionType": "git"
},
{
"status": "affected",
"version": "052e5db5be4576e0a8ef1460b210da5f328f4cd1",
"lessThan": "33609454be4f582e686a4bf13d4482a5ca0f6c4b",
"versionType": "git"
},
{
"status": "affected",
"version": "c98263d5ace597c096a7a60aeef790da7b54979e",
"lessThan": "5fdeaf591a0942772c2d18ff3563697a49ad01c6",
"versionType": "git"
},
{
"status": "affected",
"version": "0fc642f011cb7a7eff41109e66d3b552e9f4d795",
"lessThan": "4c3e25a7b711a402fcbbbcfbbdf2868ece1ae7c8",
"versionType": "git"
},
{
"status": "affected",
"version": "5116f61ab11846844585c9082c547c4ccd97ff1a",
"lessThan": "43579baa17270aa51f93eb09b6e4af6e047b7f6e",
"versionType": "git"
},
{
"status": "affected",
"version": "f31557fb1b35332cca9994aa196cef284bcf3807",
"lessThan": "95265232b49765a4d00f4d028c100bb7185600f4",
"versionType": "git"
},
{
"status": "affected",
"version": "5498227676303e3ffa9a3a46214af96bc3e81314",
"lessThan": "755a6300afbd743cda4b102f24f343380ec0e0ff",
"versionType": "git"
},
{
"status": "affected",
"version": "5498227676303e3ffa9a3a46214af96bc3e81314",
"lessThan": "7c770dadfda5cbbde6aa3c4363ed513f1d212bf8",
"versionType": "git"
},
{
"status": "affected",
"version": "5.10.248",
"lessThan": "5.10.253",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.15.198",
"lessThan": "5.15.203",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.1.160",
"lessThan": "6.1.168",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.6.120",
"lessThan": "6.6.131",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.64",
"lessThan": "6.12.80",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.18.4",
"lessThan": "6.18.21",
"versionType": "semver"
}
],
"programFiles": [
"net/openvswitch/vport-netdev.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.19",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/openvswitch/vport-netdev.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-31508
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #39912 · Revision 1
- Added to Heist Feed
- Publisher date