CVE-2026-53227

Analyzed Analyzed - Analysis Complete

NULL Pointer Dereference in Linux Kernel Open vSwitch

Publication date: 2026-06-25

Last updated on: 2026-07-02

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix possible kfree_skb of ERR_PTR After the patch in the "Fixes" tag, the allocation of the "reply" skb can happen either before or after locking the ovs_mutex. However, error cleanups still follow the classical reversed order, assuming "reply" is allocated before locking: it is freed after unlocking. If "reply" allocation happens after locking the mutex and it fails, "reply" is left with an ERR_PTR, and execution jumps to the correspondent cleanup stage which will try to free an invalid pointer. Fix this by setting the pointer to NULL after having saved its error value.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-02

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53227

EUVD

EUVD-2026-39318

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.36 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.94 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 3.16 (inc) to 5.10.259 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's openvswitch networking component. It involves improper handling of an error pointer (ERR_PTR) during memory allocation for a network buffer (skb) called "reply." The allocation of "reply" can occur either before or after locking a mutex (ovs_mutex). However, the error cleanup code assumes "reply" was allocated before locking and frees it after unlocking. If allocation happens after locking and fails, "reply" holds an ERR_PTR, and the cleanup code attempts to free this invalid pointer, leading to potential memory corruption or crashes. The fix involves setting the pointer to NULL after saving its error value to prevent freeing an invalid pointer.

Impact Analysis

This vulnerability can lead to improper memory management in the Linux kernel's openvswitch component, potentially causing system instability, crashes, or memory corruption. Such issues could disrupt network functionality or lead to denial of service conditions on affected systems.

Mitigation Strategies

The vulnerability has been resolved by a patch in the Linux kernel related to the openvswitch module. To mitigate this vulnerability, you should update your Linux kernel to a version that includes the fix for this issue.

Specifically, ensure that your system is running a kernel version that contains the patch addressing the kfree_skb of ERR_PTR issue in openvswitch.

Hi! I’m here to help you understand CVE-2026-53227. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70