CVE-2026-64531

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-07-27

Last updated on: 2026-11-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-11-03

Generated

2026-11-08

AI Q&A

2026-07-27

EPSS Evaluated

2026-11-07

NVD

CVE-2026-64531

EUVD

EUVD-2026-49109

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	057dbc5b72e9fcac439cd561c3a539b8a0edeb92
Linux	Linux	2532adbfe917c0e71dba2650ffc6efe396314c87
Linux	Linux	4b1a0ee6164c7204c68ab5a9c48c07bfe8852485
Linux	Linux	e6610f9c08b4c04cf7949c10fc246c071d00e935
Linux	Linux	a1e64addf3ff9257b45b78bc7d743781c3f41340
Linux	Linux	a1e64addf3ff9257b45b78bc7d743781c3f41340
Linux	Linux	a1e64addf3ff9257b45b78bc7d743781c3f41340
Linux	Linux	6b099d285d7ed324494b6d684f377aa103856118
Linux	Linux	5.15.180
Linux	Linux	6.1.132
Linux	Linux	6.6.84
Linux	Linux	6.12.20
Linux	Linux	6.13.8
Linux	Linux	6.14

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel's Open vSwitch involves a flaw where oversized nested action attributes can be generated. The nla_len field, which is a 16-bit unsigned integer, can be truncated if the nested action exceeds U16_MAX. This leads to a mismatch between the validated stream and the actual stream during dump or teardown operations, potentially causing bytes to be misinterpreted as independent actions.

Detection Guidance

This vulnerability is specific to the Open vSwitch kernel module and requires checking for oversized nested action attributes in flow actions. Detection involves inspecting kernel logs for errors related to Open vSwitch actions or examining flow rules for malformed attributes. Commands like dmesg | grep openvswitch or ovs-appctl dpctl/dump-flows may help identify issues, but no direct detection commands are provided in the context.

Impact Analysis

An attacker could exploit this to cause system instability or unexpected behavior by sending maliciously crafted network packets. This might lead to crashes, unauthorized actions, or resource exhaustion in systems using Open vSwitch for network management.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a Linux kernel issue in Open vSwitch that could lead to memory corruption or incorrect flow action processing, but no evidence suggests it impacts data protection or privacy compliance requirements.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves CVE-2026-64531. Ensure Open vSwitch is updated to a version that includes the fix for oversized nested action attributes.

Hi! I’m here to help you understand CVE-2026-64531. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...