CVE-2026-64531
Received Received - Intake

Buffer Overflow in Open vSwitch Kernel Module

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released. CHECK_PKT_LEN also trims its parent after branch resources are gone. SET/TUNNEL close failures unwind their known tun_dst ownership directly, and SET_TO_MASKED has no external ownership and truncates on close failure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-64531
EUVD
EUVD-2026-49109

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openvswitch openvswitch *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel's Open vSwitch involves a flaw where oversized nested action attributes can be generated. The nla_len field, which is a 16-bit unsigned integer, can be truncated if the nested action exceeds U16_MAX. This leads to a mismatch between the validated stream and the actual stream during dump or teardown operations, potentially causing bytes to be misinterpreted as independent actions.

Detection Guidance

This vulnerability is specific to the Open vSwitch kernel module and requires checking for oversized nested action attributes in flow actions. Detection involves inspecting kernel logs for errors related to Open vSwitch actions or examining flow rules for malformed attributes. Commands like dmesg | grep openvswitch or ovs-appctl dpctl/dump-flows may help identify issues, but no direct detection commands are provided in the context.

Impact Analysis

An attacker could exploit this to cause system instability or unexpected behavior by sending maliciously crafted network packets. This might lead to crashes, unauthorized actions, or resource exhaustion in systems using Open vSwitch for network management.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a Linux kernel issue in Open vSwitch that could lead to memory corruption or incorrect flow action processing, but no evidence suggests it impacts data protection or privacy compliance requirements.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves CVE-2026-64531. Ensure Open vSwitch is updated to a version that includes the fix for oversized nested action attributes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64531. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart