CVE-2026-45840
Buffer Overflow in Open vSwitch Kernel Module
Publication date: 2026-05-27
Last updated on: 2026-05-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openvswitch | openvswitch | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's openvswitch component. It involves the handling of upcall PID arrays in vport netlink reply helpers. Specifically, the system allocates a fixed-size buffer for replies but allows a CAP_NET_ADMIN user to provide a PID array large enough to overflow this buffer. This overflow causes a failure in the nla_put() function and triggers a kernel BUG, potentially leading to a kernel panic.
The issue arises because ovs_vport_set_upcall_portids() accepts any non-zero multiple of sizeof(u32) with no upper bound, allowing oversized PID arrays. On systems with unprivileged user namespaces enabled, this can be exploited by unprivileged users via certain commands. The fix involves rejecting attempts to set more PIDs than the number of CPU IDs and pre-computing the worst-case reply size to prevent overflow.
How can this vulnerability impact me? :
This vulnerability can lead to a kernel BUG and a kernel panic, causing the affected system to crash or become unstable. An attacker with CAP_NET_ADMIN privileges, or on systems with unprivileged user namespaces enabled, potentially even an unprivileged user, could exploit this to disrupt normal system operations.
Such crashes can result in denial of service (DoS), impacting availability of services running on the affected system.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by the ability to set an excessively large PID array size in Open vSwitch vport netlink replies, which can cause a kernel BUG and panic.
Immediate mitigation involves ensuring that attempts to set more PIDs than the number of CPU IDs (nr_cpu_ids) are rejected. This prevents buffer overflow in the reply buffer.
Updating the Linux kernel to a version where this issue is fixed (such as the one including the patch that rejects excessive PIDs and pre-computes the worst-case reply size) is recommended.
Additionally, restricting CAP_NET_ADMIN permissions to trusted users and disabling unprivileged user namespaces (if not needed) can reduce the risk of exploitation.