CVE-2026-80994 - Vulnerability Details

- net: openvswitch: fix flow mask use-after-free on flow deletion

Description

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix flow mask use-after-free on flow deletion

The commit in the Fixes tag below made so flow->mask free is scheduled
via RCU right after it is removed from the flow table. The pointer
stays in the flow structure and it can be accessible while in the same
RCU critical section. This is done to avoid requiring ovs_mutex for
the ovs_flow_free().

However, while removing the flow during processing of CMD_DEL, we do
not take RCU read lock before the removal, and ovs_flow_cmd_fill_info()
uses the flow->mask pointer afterwards. The RCU read lock is taken,
but it's already late at that point. The comment on that line
acknowledges that the lock is cosmetic and doesn't serve a real purpose.

This leads to use-after-free if the RCU grace period passes between
removal and the filling. It is a short race window, but it is there
and can lead to a real crash in case memory allocation for the info
takes a bit longer:

BUG: KASAN: slab-use-after-free in __ovs_nla_put_key
net/openvswitch/flow_netlink.c:1996
BUG: KASAN: slab-use-after-free in ovs_nla_put_key+0x2463/0x2e30
net/openvswitch/flow_netlink.c:2250
Read of size 4 at addr ffff88801ee89970 by task ovs_flow_del_ec/9487

Call Trace:
<TASK>
__ovs_nla_put_key net/openvswitch/flow_netlink.c:1996
ovs_nla_put_key+0x2463/0x2e30 net/openvswitch/flow_netlink.c:2250
ovs_flow_cmd_fill_info+0x420/0x9c0 net/openvswitch/datapath.c:930
ovs_flow_cmd_del+0x53a/0x970 net/openvswitch/datapath.c:1467
...
netlink_rcv_skb+0x156/0x420 net/netlink/af_netlink.c:2556
</TASK>

Allocated by task 9487:
mask_alloc net/openvswitch/flow_table.c:967
flow_mask_insert net/openvswitch/flow_table.c:1012
ovs_flow_tbl_insert+0xea2/0x1a90 net/openvswitch/flow_table.c:1084
ovs_flow_cmd_new+0x7e3/0xd90 net/openvswitch/datapath.c:1086
...
netlink_rcv_skb+0x156/0x420 net/netlink/af_netlink.c:2556

Freed by task 9485:
rcu_free_sheaf+0x1e/0x100 mm/slub.c:5978
rcu_do_batch kernel/rcu/tree.c:2645
rcu_core+0x59c/0x10c0 kernel/rcu/tree.c:2897
handle_softirqs+0x1e4/0x9a0 kernel/softirq.c:622
...
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062

ovs_flow_tbl_remove() must be called after the ovs_flow_cmd_fill_info()
to avoid this race. This also helps with cleaning up the forced cast
and the cosmetic RCU read lock. Before the commit in the Fixes tag the
order did not matter as long as the flow object itself was not freed.

A wider RCU critical section could be another option, but we have a
GFP_KERNEL allocation in the way.

Reported by Trend Micro's Zero Day Initiative as ZDI-CAN-32042.

Published: 2026-09-11

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

This vulnerability arises from a use‑after‑free in the Linux kernel’s Open vSwitch implementation. When a flow is deleted, the mask memory is freed via RCU but the deletion code still accesses the mask pointer while inside the same RCU critical section, creating a race window. If the RCU grace period expires before the flow information is filled, a kernel panic occurs, effectively crashing the host. The flaw does not expose confidential data but can cause a denial of service in traffic‑handled systems.

Affected Systems

The affected component is the Linux kernel’s Open vSwitch networking stack, which is used in many Linux distributions that ship with Open vSwitch. All kernel versions including the kernel from the commit that fixed the race window prior to this vulnerability are at risk. Packages that load the Open vSwitch kernel modules without applying the patch can also be impacted.

Risk and Exploitability

The CVSS score is 4.1, indicating a low severity overall. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. The attack window is a brief race condition during flow deletion, so timely application of the kernel patch is essential to mitigate any potential crash.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`56c19868e115fcf8d62d843e1b9616bb9837d0db`	affected	< 0ba5cbc2f049af94ec94ff6f64958545efc5eaa2
`56c19868e115fcf8d62d843e1b9616bb9837d0db`	affected	< ac73e3af571da06c1d1cfe3f0f00dc978b851700
`56c19868e115fcf8d62d843e1b9616bb9837d0db`	affected	< 7f072b84afd05a77963eb1872f7174e280661dce
`56c19868e115fcf8d62d843e1b9616bb9837d0db`	affected	< 4e30317ff67a2eb12b4d890d39f72fd7e7117d48

Linux

affected

Version	Status	Constraints
`3.16`	affected	—
`0`	unaffected	< 3.16
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[56c19868e115fcf8d62d843e1b9616bb9837d0db,0ba5cbc2f049af94ec94ff6f64958545efc5eaa2)`	affected	code_commit	—
`[56c19868e115fcf8d62d843e1b9616bb9837d0db,ac73e3af571da06c1d1cfe3f0f00dc978b851700)`	affected	code_commit	—
`[56c19868e115fcf8d62d843e1b9616bb9837d0db,7f072b84afd05a77963eb1872f7174e280661dce)`	affected	code_commit	—
`[56c19868e115fcf8d62d843e1b9616bb9837d0db,4e30317ff67a2eb12b4d890d39f72fd7e7117d48)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.16`	affected	generic	—
`[0,3.16)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel release that contains the Open vSwitch use‑after‑free fix
Upgrade Open vSwitch to a version that includes the kernel patch or rebuild the kernel with the patch applied
If updates cannot be applied immediately, disable or remove the Open vSwitch kernel module from the system to eliminate the crash risk

Generated by OpenCVE AI on September 12, 2026 at 01:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0ba5cbc2f049af94ec94ff6f64958545efc5eaa2
https://git.kernel.org/stable/c/4e30317ff67a2eb12b4d890d39f72fd7e7117d48
https://git.kernel.org/stable/c/7f072b84afd05a77963eb1872f7174e280661dce
https://git.kernel.org/stable/c/ac73e3af571da06c1d1cfe3f0f00dc978b851700
https://nvd.nist.gov/vuln/detail/CVE-2026-80994
https://www.cve.org/CVERecord?id=CVE-2026-80994

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-80994 https://www.cve.org/CVERecord?id=CVE-2026-80994
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix flow mask use-after-free on flow deletion The commit in the Fixes tag below made so flow->mask free is scheduled via RCU right after it is removed from the flow table. The pointer stays in the flow structure and it can be accessible while in the same RCU critical section. This is done to avoid requiring ovs_mutex for the ovs_flow_free(). However, while removing the flow during processing of CMD_DEL, we do not take RCU read lock before the removal, and ovs_flow_cmd_fill_info() uses the flow->mask pointer afterwards. The RCU read lock is taken, but it's already late at that point. The comment on that line acknowledges that the lock is cosmetic and doesn't serve a real purpose. This leads to use-after-free if the RCU grace period passes between removal and the filling. It is a short race window, but it is there and can lead to a real crash in case memory allocation for the info takes a bit longer: BUG: KASAN: slab-use-after-free in __ovs_nla_put_key net/openvswitch/flow_netlink.c:1996 BUG: KASAN: slab-use-after-free in ovs_nla_put_key+0x2463/0x2e30 net/openvswitch/flow_netlink.c:2250 Read of size 4 at addr ffff88801ee89970 by task ovs_flow_del_ec/9487 Call Trace: <TASK> __ovs_nla_put_key net/openvswitch/flow_netlink.c:1996 ovs_nla_put_key+0x2463/0x2e30 net/openvswitch/flow_netlink.c:2250 ovs_flow_cmd_fill_info+0x420/0x9c0 net/openvswitch/datapath.c:930 ovs_flow_cmd_del+0x53a/0x970 net/openvswitch/datapath.c:1467 ... netlink_rcv_skb+0x156/0x420 net/netlink/af_netlink.c:2556 </TASK> Allocated by task 9487: mask_alloc net/openvswitch/flow_table.c:967 flow_mask_insert net/openvswitch/flow_table.c:1012 ovs_flow_tbl_insert+0xea2/0x1a90 net/openvswitch/flow_table.c:1084 ovs_flow_cmd_new+0x7e3/0xd90 net/openvswitch/datapath.c:1086 ... netlink_rcv_skb+0x156/0x420 net/netlink/af_netlink.c:2556 Freed by task 9485: rcu_free_sheaf+0x1e/0x100 mm/slub.c:5978 rcu_do_batch kernel/rcu/tree.c:2645 rcu_core+0x59c/0x10c0 kernel/rcu/tree.c:2897 handle_softirqs+0x1e4/0x9a0 kernel/softirq.c:622 ... instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 ovs_flow_tbl_remove() must be called after the ovs_flow_cmd_fill_info() to avoid this race. This also helps with cleaning up the forced cast and the cosmetic RCU read lock. Before the commit in the Fixes tag the order did not matter as long as the flow object itself was not freed. A wider RCU critical section could be another option, but we have a GFP_KERNEL allocation in the way. Reported by Trend Micro's Zero Day Initiative as ZDI-CAN-32042.
Title		net: openvswitch: fix flow mask use-after-free on flow deletion
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0ba5cbc2f049af94ec94ff6f64958545efc5eaa2 https://git.kernel.org/stable/c/4e30317ff67a2eb12b4d890d39f72fd7e7117d48 https://git.kernel.org/stable/c/7f072b84afd05a77963eb1872f7174e280661dce https://git.kernel.org/stable/c/ac73e3af571da06c1d1cfe3f0f00dc978b851700

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:42:50.199Z

Updated: 2026-09-13T06:28:57.588Z

Reserved: 2026-08-26T14:34:25.812Z

Link: CVE-2026-80994

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:06.357

Modified: 2026-09-13T07:17:06.087

Link: CVE-2026-80994

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:42:50Z

Links: CVE-2026-80994 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-12T04:15:05Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object