CVE-2026-80994 - Vulnerability Details

- net: openvswitch: fix flow mask use-after-free on flow deletion

Description

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix flow mask use-after-free on flow deletion

The commit in the Fixes tag below made so flow->mask free is scheduled
via RCU right after it is removed from the flow table. The pointer
stays in the flow structure and it can be accessible while in the same
RCU critical section. This is done to avoid requiring ovs_mutex for
the ovs_flow_free().

However, while removing the flow during processing of CMD_DEL, we do
not take RCU read lock before the removal, and ovs_flow_cmd_fill_info()
uses the flow->mask pointer afterwards. The RCU read lock is taken,
but it's already late at that point. The comment on that line
acknowledges that the lock is cosmetic and doesn't serve a real purpose.

This leads to use-after-free if the RCU grace period passes between
removal and the filling. It is a short race window, but it is there
and can lead to a real crash in case memory allocation for the info
takes a bit longer:

BUG: KASAN: slab-use-after-free in __ovs_nla_put_key
net/openvswitch/flow_netlink.c:1996
BUG: KASAN: slab-use-after-free in ovs_nla_put_key+0x2463/0x2e30
net/openvswitch/flow_netlink.c:2250
Read of size 4 at addr ffff88801ee89970 by task ovs_flow_del_ec/9487

Call Trace:
<TASK>
__ovs_nla_put_key net/openvswitch/flow_netlink.c:1996
ovs_nla_put_key+0x2463/0x2e30 net/openvswitch/flow_netlink.c:2250
ovs_flow_cmd_fill_info+0x420/0x9c0 net/openvswitch/datapath.c:930
ovs_flow_cmd_del+0x53a/0x970 net/openvswitch/datapath.c:1467
...
netlink_rcv_skb+0x156/0x420 net/netlink/af_netlink.c:2556
</TASK>

Allocated by task 9487:
mask_alloc net/openvswitch/flow_table.c:967
flow_mask_insert net/openvswitch/flow_table.c:1012
ovs_flow_tbl_insert+0xea2/0x1a90 net/openvswitch/flow_table.c:1084
ovs_flow_cmd_new+0x7e3/0xd90 net/openvswitch/datapath.c:1086
...
netlink_rcv_skb+0x156/0x420 net/netlink/af_netlink.c:2556

Freed by task 9485:
rcu_free_sheaf+0x1e/0x100 mm/slub.c:5978
rcu_do_batch kernel/rcu/tree.c:2645
rcu_core+0x59c/0x10c0 kernel/rcu/tree.c:2897
handle_softirqs+0x1e4/0x9a0 kernel/softirq.c:622
...
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062

ovs_flow_tbl_remove() must be called after the ovs_flow_cmd_fill_info()
to avoid this race. This also helps with cleaning up the forced cast
and the cosmetic RCU read lock. Before the commit in the Fixes tag the
order did not matter as long as the flow object itself was not freed.

A wider RCU critical section could be another option, but we have a
GFP_KERNEL allocation in the way.

Reported by Trend Micro's Zero Day Initiative as ZDI-CAN-32042.

Published: 2026-09-11

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a use‑after‑free in the Linux kernel Open VSwitch code. When a flow table entry is deleted, the mask pointer is freed via RCU, yet the deletion path still accesses that pointer before proper RCU synchronization. This race can lead to a kernel crash. Based on the reported kernel crash, it is inferred that the fault does not expose sensitive data. The resulting crash terminates the kernel, causing a denial‑of‑service flaw (CWE‑825).

Affected Systems

Affected systems are Linux kernel releases that include the Open VSwitch module with legacy flow deletion logic. The kernel version range is not specified in the advisory, so any kernel that implements the unpatched flow‑deletion path is potentially vulnerable. Systems running the module appear on any Linux platform that ships with Open VSwitch support.

Risk and Exploitability

The CVSS score of 7.8 indicates medium‑high severity, while the EPSS score of <1% points to a low probability of exploitation in the wild. The issue is not listed in CISA's KEV catalog. Exploitation issuing a flow‑deletion netlink command during the RCU grace period. The likely attack vector is via the Open VSwitch netlink interface; if this interface is exposed to untrusted networks, remote exploitation becomes possible—this inference is based on the description’s mention of netlink commands and the absence of network restrictions.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`56c19868e115fcf8d62d843e1b9616bb9837d0db`	affected	< ea5f7b45b582665541ddfb77dce98611354af4ab
`56c19868e115fcf8d62d843e1b9616bb9837d0db`	affected	< 18ce1a8b7499c016d4a893d9b1db80608f73745d
`56c19868e115fcf8d62d843e1b9616bb9837d0db`	affected	< c15ef9a5bf594f93a31de2ec2ec394e2a903519a
`56c19868e115fcf8d62d843e1b9616bb9837d0db`	affected	< 64051fe200c7c759af71634bd2123552eaabb69a
`56c19868e115fcf8d62d843e1b9616bb9837d0db`	affected	< 0ba5cbc2f049af94ec94ff6f64958545efc5eaa2
`56c19868e115fcf8d62d843e1b9616bb9837d0db`	affected	< ac73e3af571da06c1d1cfe3f0f00dc978b851700
`56c19868e115fcf8d62d843e1b9616bb9837d0db`	affected	< 7f072b84afd05a77963eb1872f7174e280661dce
`56c19868e115fcf8d62d843e1b9616bb9837d0db`	affected	< 4e30317ff67a2eb12b4d890d39f72fd7e7117d48

Linux

affected

Version	Status	Constraints
`3.16`	affected	—
`0`	unaffected	< 3.16
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[56c19868e115fcf8d62d843e1b9616bb9837d0db,0ba5cbc2f049af94ec94ff6f64958545efc5eaa2)`	affected	code_commit	—
`[56c19868e115fcf8d62d843e1b9616bb9837d0db,ac73e3af571da06c1d1cfe3f0f00dc978b851700)`	affected	code_commit	—
`[56c19868e115fcf8d62d843e1b9616bb9837d0db,7f072b84afd05a77963eb1872f7174e280661dce)`	affected	code_commit	—
`[56c19868e115fcf8d62d843e1b9616bb9837d0db,4e30317ff67a2eb12b4d890d39f72fd7e7117d48)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.16`	affected	generic	—
`[0,3.16)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that fixes the use‑after‑free in the Open VSwitch module or install a distribution kernel that includes the update
Rebuild or upgrade the kernel with the updated Open VSwitch code to guarantee the corrected logic is in use
If upgrading is not immediately feasible, unload or disable the openvswitch kernel module or restrict netlink access to prevent flow‑deletion commands from untrusted sources

Generated by OpenCVE AI on September 21, 2026 at 03:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00171.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0ba5cbc2f049af94ec94ff6f64958545efc5eaa2
https://git.kernel.org/stable/c/18ce1a8b7499c016d4a893d9b1db80608f73745d
https://git.kernel.org/stable/c/4e30317ff67a2eb12b4d890d39f72fd7e7117d48
https://git.kernel.org/stable/c/64051fe200c7c759af71634bd2123552eaabb69a
https://git.kernel.org/stable/c/7f072b84afd05a77963eb1872f7174e280661dce
https://git.kernel.org/stable/c/ac73e3af571da06c1d1cfe3f0f00dc978b851700
https://git.kernel.org/stable/c/c15ef9a5bf594f93a31de2ec2ec394e2a903519a
https://git.kernel.org/stable/c/ea5f7b45b582665541ddfb77dce98611354af4ab
https://nvd.nist.gov/vuln/detail/CVE-2026-80994
https://www.cve.org/CVERecord?id=CVE-2026-80994

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/18ce1a8b7499c016d4a893d9b1db80608f73745d https://git.kernel.org/stable/c/64051fe200c7c759af71634bd2123552eaabb69a https://git.kernel.org/stable/c/c15ef9a5bf594f93a31de2ec2ec394e2a903519a https://git.kernel.org/stable/c/ea5f7b45b582665541ddfb77dce98611354af4ab

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-80994 https://www.cve.org/CVERecord?id=CVE-2026-80994
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix flow mask use-after-free on flow deletion The commit in the Fixes tag below made so flow->mask free is scheduled via RCU right after it is removed from the flow table. The pointer stays in the flow structure and it can be accessible while in the same RCU critical section. This is done to avoid requiring ovs_mutex for the ovs_flow_free(). However, while removing the flow during processing of CMD_DEL, we do not take RCU read lock before the removal, and ovs_flow_cmd_fill_info() uses the flow->mask pointer afterwards. The RCU read lock is taken, but it's already late at that point. The comment on that line acknowledges that the lock is cosmetic and doesn't serve a real purpose. This leads to use-after-free if the RCU grace period passes between removal and the filling. It is a short race window, but it is there and can lead to a real crash in case memory allocation for the info takes a bit longer: BUG: KASAN: slab-use-after-free in __ovs_nla_put_key net/openvswitch/flow_netlink.c:1996 BUG: KASAN: slab-use-after-free in ovs_nla_put_key+0x2463/0x2e30 net/openvswitch/flow_netlink.c:2250 Read of size 4 at addr ffff88801ee89970 by task ovs_flow_del_ec/9487 Call Trace: <TASK> __ovs_nla_put_key net/openvswitch/flow_netlink.c:1996 ovs_nla_put_key+0x2463/0x2e30 net/openvswitch/flow_netlink.c:2250 ovs_flow_cmd_fill_info+0x420/0x9c0 net/openvswitch/datapath.c:930 ovs_flow_cmd_del+0x53a/0x970 net/openvswitch/datapath.c:1467 ... netlink_rcv_skb+0x156/0x420 net/netlink/af_netlink.c:2556 </TASK> Allocated by task 9487: mask_alloc net/openvswitch/flow_table.c:967 flow_mask_insert net/openvswitch/flow_table.c:1012 ovs_flow_tbl_insert+0xea2/0x1a90 net/openvswitch/flow_table.c:1084 ovs_flow_cmd_new+0x7e3/0xd90 net/openvswitch/datapath.c:1086 ... netlink_rcv_skb+0x156/0x420 net/netlink/af_netlink.c:2556 Freed by task 9485: rcu_free_sheaf+0x1e/0x100 mm/slub.c:5978 rcu_do_batch kernel/rcu/tree.c:2645 rcu_core+0x59c/0x10c0 kernel/rcu/tree.c:2897 handle_softirqs+0x1e4/0x9a0 kernel/softirq.c:622 ... instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 ovs_flow_tbl_remove() must be called after the ovs_flow_cmd_fill_info() to avoid this race. This also helps with cleaning up the forced cast and the cosmetic RCU read lock. Before the commit in the Fixes tag the order did not matter as long as the flow object itself was not freed. A wider RCU critical section could be another option, but we have a GFP_KERNEL allocation in the way. Reported by Trend Micro's Zero Day Initiative as ZDI-CAN-32042.
Title		net: openvswitch: fix flow mask use-after-free on flow deletion
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0ba5cbc2f049af94ec94ff6f64958545efc5eaa2 https://git.kernel.org/stable/c/4e30317ff67a2eb12b4d890d39f72fd7e7117d48 https://git.kernel.org/stable/c/7f072b84afd05a77963eb1872f7174e280661dce https://git.kernel.org/stable/c/ac73e3af571da06c1d1cfe3f0f00dc978b851700

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:42:50.199Z

Updated: 2026-09-14T11:59:34.227Z

Reserved: 2026-08-26T14:34:25.812Z

Link: CVE-2026-80994

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:06.357

Modified: 2026-09-14T13:18:54.043

Link: CVE-2026-80994

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:42:50Z

Links: CVE-2026-80994 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-21T03:45:08Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object