CVE-2026-89488

openvswitch: Fix CT limit teardown use-after-free

Published Sep 11, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: Fix CT limit teardown use-after-free

Packet processing uses CT limit state under RCU, while netns teardown
frees that state under ovs_mutex. The CT limit pointer was neither removed
from readers nor protected by a grace period, allowing packet processing to
dereference the freed state.

An unprivileged user can trigger this bug from a user and network
namespace, causing a slab-use-after-free in ovs_ct_execute() when the
netns is torn down.

Publish the CT limit pointer through RCU, remove it before teardown, and
wait for readers before freeing its contents. Keep ovs_mutex around
individual CT limit updates, and use the RCU read-side lock while GET
traverses the RCU-protected limit lists.

Netns teardown detaches the RCU-protected CT limit state in the pernet
.pre_exit callback while holding ovs_mutex. The pernet core guarantees an
RCU grace period between the .pre_exit and .exit callbacks, so the .exit
callback completes the teardown without adding any extra synchronization.

The netlink command handlers do not need NULL checks because the userspace
netlink socket holds an active reference to its network namespace while a
request is processed. The per-netns exit path therefore cannot run
concurrently with SET, DEL, or GET for that socket's namespace.

Analysis

Technical impact

A use‑after‑free flaw in the Linux kernel’s Open vSwitch CT limit handling allows an unprivileged user to torn down. The flaw occurs when packet processing still resulting in a slab-use‑after‑free in ovs_ct_execute(). This kernel memory corruption could enable arbitrary code execution at the kernel level, as it forms a classic use‑after‑free defect tied to CWE‑825.

Affected Systems

All Linux kernel versions that contain the Open vSwitch implementation are affected, regardless of distribution. The vulnerability exists in the kernel’s networking subsystem, so any system running a susceptible kernel variant that uses Open vSwitch may be vulnerable if it allows unprivileged users to create or manipulate network namespaces.

Risk and Exploitability

The problem is a kernel flaw with a CVSS score of 7.8, indicating a high severity. An unprivileged user within a a netlink request that causes the relevant namespace to be torn down while traffic is still being processed. The EPSS score is < 1 %, implying a low probability of exploitation, and the vulnerability is not listed in CISA KEV, meaning no known active exploitation is documented. The likely attack vector is local, requiring no elevated privileges and no network connectivity.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`11efd5cb04a184eea4f57b68ea63dddd463158d1`	affected	< 239f26589a6926db28c436e14f28517581ef1385
`11efd5cb04a184eea4f57b68ea63dddd463158d1`	affected	< 3b9369881b403f4cdbb11fa998554382bdcc3d8c
`11efd5cb04a184eea4f57b68ea63dddd463158d1`	affected	< 3b41d907400cc1dd1da9555b81dca422b1f44433
`11efd5cb04a184eea4f57b68ea63dddd463158d1`	affected	< 680f20d5937fa4d1367c59fe83091b78041015f5
`11efd5cb04a184eea4f57b68ea63dddd463158d1`	affected	< bf4aaa7ea2579e24ed7de2e20578a875bebca011
`11efd5cb04a184eea4f57b68ea63dddd463158d1`	affected	< e15407c3a8a005324f633cd46cd8fb58042c1157
`11efd5cb04a184eea4f57b68ea63dddd463158d1`	affected	< 6a6d36fadb8537d9b79e72c9fa51885ec0c33e10
`11efd5cb04a184eea4f57b68ea63dddd463158d1`	affected	< 403f96c32c9e24600093d7d0c61c17daeedca957

Linux

affected

Version	Status	Constraints
`4.18`	affected	—
`0`	unaffected	< 4.18
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[11efd5cb04a184eea4f57b68ea63dddd463158d1,e15407c3a8a005324f633cd46cd8fb58042c1157)`	affected	code_commit	—
`[11efd5cb04a184eea4f57b68ea63dddd463158d1,6a6d36fadb8537d9b79e72c9fa51885ec0c33e10)`	affected	code_commit	—
`[11efd5cb04a184eea4f57b68ea63dddd463158d1,403f96c32c9e24600093d7d0c61c17daeedca957)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.18`	affected	generic	—
`[0,4.18)`	unaffected	generic	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch‑free
Reboot or restart the system after applying the patch
As a temporary measure avoid tearing down network namespaces while traffic is still being processed or limit unprivileged users from creating or managing network namespaces

Generated by OpenCVE AI on September 15, 2026 at 22:42 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.126% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/239f26589a6926db28c436e14f28517581ef1385
https://git.kernel.org/stable/c/3b41d907400cc1dd1da9555b81dca422b1f44433
https://git.kernel.org/stable/c/3b9369881b403f4cdbb11fa998554382bdcc3d8c
https://git.kernel.org/stable/c/403f96c32c9e24600093d7d0c61c17daeedca957
https://git.kernel.org/stable/c/680f20d5937fa4d1367c59fe83091b78041015f5
https://git.kernel.org/stable/c/6a6d36fadb8537d9b79e72c9fa51885ec0c33e10
https://git.kernel.org/stable/c/bf4aaa7ea2579e24ed7de2e20578a875bebca011
https://git.kernel.org/stable/c/e15407c3a8a005324f633cd46cd8fb58042c1157
https://nvd.nist.gov/vuln/detail/CVE-2026-89488
https://www.cve.org/CVERecord?id=CVE-2026-89488

History

Oct 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 14, 2026 12:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/239f26589a6926db28c436e14f28517581ef1385 https://git.kernel.org/stable/c/3b41d907400cc1dd1da9555b81dca422b1f44433 https://git.kernel.org/stable/c/3b9369881b403f4cdbb11fa998554382bdcc3d8c https://git.kernel.org/stable/c/680f20d5937fa4d1367c59fe83091b78041015f5 https://git.kernel.org/stable/c/bf4aaa7ea2579e24ed7de2e20578a875bebca011

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 3:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-416

Sep 12, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89488 https://www.cve.org/CVERecord?id=CVE-2026-89488
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 12, 2026 10:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovs_mutex. The CT limit pointer was neither removed from readers nor protected by a grace period, allowing packet processing to dereference the freed state. An unprivileged user can trigger this bug from a user and network namespace, causing a slab-use-after-free in ovs_ct_execute() when the netns is torn down. Publish the CT limit pointer through RCU, remove it before teardown, and wait for readers before freeing its contents. Keep ovs_mutex around individual CT limit updates, and use the RCU read-side lock while GET traverses the RCU-protected limit lists. Netns teardown detaches the RCU-protected CT limit state in the pernet .pre_exit callback while holding ovs_mutex. The pernet core guarantees an RCU grace period between the .pre_exit and .exit callbacks, so the .exit callback completes the teardown without adding any extra synchronization. The netlink command handlers do not need NULL checks because the userspace netlink socket holds an active reference to its network namespace while a request is processed. The per-netns exit path therefore cannot run concurrently with SET, DEL, or GET for that socket's namespace.
Title		openvswitch: Fix CT limit teardown use-after-free
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/403f96c32c9e24600093d7d0c61c17daeedca957 https://git.kernel.org/stable/c/6a6d36fadb8537d9b79e72c9fa51885ec0c33e10 https://git.kernel.org/stable/c/e15407c3a8a005324f633cd46cd8fb58042c1157