CVE-2026-99025 - Vulnerability Details

- openvswitch: fix soft lockup in the netlink flow dump

Description

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: fix soft lockup in the netlink flow dump

A production compute node carrying a few thousand datapath flows hit a
soft lockup inside a single netlink flow dump and panicked.

ovs_flow_cmd_dump() calls ovs_flow_stats_get() for every flow it
emits, and that releases stats->lock with spin_unlock_bh() once per
CPU that has touched the flow. Every release is a local_bh_enable(),
and each one runs the pending softirq backlog in the dumping thread's
own context.

The skb bounds the flows one callback emits, but not the softirq work
it absorbs. On a CPU that carries the box's packet load the backlog
refills as fast as it drains, so the dumping thread becomes that CPU's
softirq engine. It never sleeps and it has no reschedule point, so
under voluntary preemption nothing can take the CPU away from it:
neither the ksoftirqd the kernel woke to take the work over, nor the
stopper thread the softlockup detector dispatches to refresh its
timestamp.

Hold BH off across the whole callback instead, the way
ctnetlink_dump_table() does, so the nested spin_unlock_bh() stop
draining softirqs. The loop already runs under rcu_read_lock() and
cannot sleep. What it gives up is preemption under CONFIG_PREEMPT,
since a BH-off region is not preemptible outside PREEMPT_RT. The
region stays short: the skb caps the flows one callback emits, and
empty buckets cost no skb space but are each visited once per dump, as
the cursor only moves forward. The table grows on insert and shrinks
only on flush, so the walk is bounded by the largest flow count the
datapath has held. The softirq backlog the callback used to absorb has
no bound at all.

Published: 2026-10-23

Score: 4.7 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A bug in the Linux kernel implementation of Open vSwitch causes a soft lockup when dumping netlink flow statistics. During a dump, each flow triggers a release of a lock that inadvertently runs pending softirq work in the same CPU context. If a compute node has many datapath flows, the backlog refills as it drains, turning the dumping thread into the CPU’s softirq engine. The thread never sleeps or yields, creating a hard lockup that forces the kernel to panic. This flaw stops system activity for that CPU, effectively denying local services.

Affected Systems

Affected systems are all Linux kernel installations that include the Open vSwitch kernel module. Any kernel version before the patch may be vulnerable.

Risk and Exploitability

Risk and exploitability are significant for systems running Open vSwitch with many datapath flows. Based on the description, it is inferred that only users with elevated or administrative privileges can invoke a netlink flow dump, limiting the threat to local or privileged attackers. An attacker with such privileges can trigger a kernel panic, leading to a denial‑of‑service condition on the affected host. The CVSS score is 4.7, the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`63e7959c4b9bd6f791061c460a22d9ee32ae2240`	affected	< ef77dd59cb7b7b0ac0bedd3fe9ee7a8acd8a58f2
`63e7959c4b9bd6f791061c460a22d9ee32ae2240`	affected	< 9ffb9897b39037a688ae01d0b3aea4ccce27dd75
`63e7959c4b9bd6f791061c460a22d9ee32ae2240`	affected	< 5b6a8bbdcdd7d0fddee466c1c7fe5b7f30aa392c
`63e7959c4b9bd6f791061c460a22d9ee32ae2240`	affected	< c995c52eba1926a5e82823fa5573a6f1b1010e5d
`63e7959c4b9bd6f791061c460a22d9ee32ae2240`	affected	< b872de585edff534056c65ba30970b68499fca14
`63e7959c4b9bd6f791061c460a22d9ee32ae2240`	affected	< 55f12552b00a34ca7ab5cf2d2b5ed02f8f06a965
`63e7959c4b9bd6f791061c460a22d9ee32ae2240`	affected	< 80db24f3c16fdeef85460d9d66a4aae7a9cb92b4
`63e7959c4b9bd6f791061c460a22d9ee32ae2240`	affected	< aaaaf87ea99b8766c9a8aa0e71aa42e6bc8a5320

Linux

affected

Version	Status	Constraints
`3.16`	affected	—
`0`	unaffected	< 3.16
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`7.2.11`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[63e7959c4b9bd6f791061c460a22d9ee32ae2240,c995c52eba1926a5e82823fa5573a6f1b1010e5d)`	affected	code_commit	—
`[63e7959c4b9bd6f791061c460a22d9ee32ae2240,b872de585edff534056c65ba30970b68499fca14)`	affected	code_commit	—
`[63e7959c4b9bd6f791061c460a22d9ee32ae2240,55f12552b00a34ca7ab5cf2d2b5ed02f8f06a965)`	affected	code_commit	—
`[63e7959c4b9bd6f791061c460a22d9ee32ae2240,80db24f3c16fdeef85460d9d66a4aae7a9cb92b4)`	affected	code_commit	—
`[63e7959c4b9bd6f791061c460a22d9ee32ae2240,aaaaf87ea99b8766c9a8aa0e71aa42e6bc8a5320)`	affected	code_commit	—

Linux

100%

Version	Status	Scheme	Platform
`3.16`	affected	generic	—
`[0,3.16)`	unaffected	generic	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[63e7959c4b9bd6f791061c460a22d9ee32ae2240,c995c52eba1926a5e82823fa5573a6f1b1010e5d)`	affected	code_commit	—
`[63e7959c4b9bd6f791061c460a22d9ee32ae2240,b872de585edff534056c65ba30970b68499fca14)`	affected	code_commit	—
`[63e7959c4b9bd6f791061c460a22d9ee32ae2240,55f12552b00a34ca7ab5cf2d2b5ed02f8f06a965)`	affected	code_commit	—
`[63e7959c4b9bd6f791061c460a22d9ee32ae2240,80db24f3c16fdeef85460d9d66a4aae7a9cb92b4)`	affected	code_commit	—
`[63e7959c4b9bd6f791061c460a22d9ee32ae2240,aaaaf87ea99b8766c9a8aa0e71aa42e6bc8a5320)`	affected	code_commit	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`3.16`	affected	generic	—
`[0,3.16)`	unaffected	generic	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that includes the Open vSwitch fix
Ensure the Open vSwitch kernel module is updated to the patched version
If an update is delayed, disable or restrict use of the netlink flow dump on nodes with large datapath flow counts to avoid triggering the lockup
Consider limiting flow table size or disabling debug dumps until a patch is applied

Generated by OpenCVE AI on October 29, 2026 at 19:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99025.mbox
https://git.kernel.org/stable/c/55f12552b00a34ca7ab5cf2d2b5ed02f8f06a965
https://git.kernel.org/stable/c/5b6a8bbdcdd7d0fddee466c1c7fe5b7f30aa392c
https://git.kernel.org/stable/c/80db24f3c16fdeef85460d9d66a4aae7a9cb92b4
https://git.kernel.org/stable/c/9ffb9897b39037a688ae01d0b3aea4ccce27dd75
https://git.kernel.org/stable/c/aaaaf87ea99b8766c9a8aa0e71aa42e6bc8a5320
https://git.kernel.org/stable/c/b872de585edff534056c65ba30970b68499fca14
https://git.kernel.org/stable/c/c995c52eba1926a5e82823fa5573a6f1b1010e5d
https://git.kernel.org/stable/c/ef77dd59cb7b7b0ac0bedd3fe9ee7a8acd8a58f2
https://nvd.nist.gov/vuln/detail/CVE-2026-99025
https://www.cve.org/CVERecord?id=CVE-2026-99025

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/5b6a8bbdcdd7d0fddee466c1c7fe5b7f30aa392c https://git.kernel.org/stable/c/9ffb9897b39037a688ae01d0b3aea4ccce27dd75 https://git.kernel.org/stable/c/ef77dd59cb7b7b0ac0bedd3fe9ee7a8acd8a58f2

Thu, 29 Oct 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-360 CWE-749

Thu, 29 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-835
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99025.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-99025 https://www.cve.org/CVERecord?id=CVE-2026-99025
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 24 Oct 2026 00:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-360 CWE-749

Fri, 23 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying a few thousand datapath flows hit a soft lockup inside a single netlink flow dump and panicked. ovs_flow_cmd_dump() calls ovs_flow_stats_get() for every flow it emits, and that releases stats->lock with spin_unlock_bh() once per CPU that has touched the flow. Every release is a local_bh_enable(), and each one runs the pending softirq backlog in the dumping thread's own context. The skb bounds the flows one callback emits, but not the softirq work it absorbs. On a CPU that carries the box's packet load the backlog refills as fast as it drains, so the dumping thread becomes that CPU's softirq engine. It never sleeps and it has no reschedule point, so under voluntary preemption nothing can take the CPU away from it: neither the ksoftirqd the kernel woke to take the work over, nor the stopper thread the softlockup detector dispatches to refresh its timestamp. Hold BH off across the whole callback instead, the way ctnetlink_dump_table() does, so the nested spin_unlock_bh() stop draining softirqs. The loop already runs under rcu_read_lock() and cannot sleep. What it gives up is preemption under CONFIG_PREEMPT, since a BH-off region is not preemptible outside PREEMPT_RT. The region stays short: the skb caps the flows one callback emits, and empty buckets cost no skb space but are each visited once per dump, as the cursor only moves forward. The table grows on insert and shrinks only on flush, so the walk is bounded by the largest flow count the datapath has held. The softirq backlog the callback used to absorb has no bound at all.
Title		openvswitch: fix soft lockup in the netlink flow dump
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/55f12552b00a34ca7ab5cf2d2b5ed02f8f06a965 https://git.kernel.org/stable/c/80db24f3c16fdeef85460d9d66a4aae7a9cb92b4 https://git.kernel.org/stable/c/aaaaf87ea99b8766c9a8aa0e71aa42e6bc8a5320 https://git.kernel.org/stable/c/b872de585edff534056c65ba30970b68499fca14 https://git.kernel.org/stable/c/c995c52eba1926a5e82823fa5573a6f1b1010e5d

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:21:12.410Z

Updated: 2026-10-30T12:41:01.936Z

Reserved: 2026-09-25T10:25:14.386Z

Link: CVE-2026-99025

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:25.480

Modified: 2026-10-30T13:21:38.963

Link: CVE-2026-99025

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-99025 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-29T20:00:29Z

Weaknesses

CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object