CVE-2026-74664
Received Received - Intake

Openvswitch Flow Update Reply Reallocation Vulnerability

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reallocate update replies for mismatched IDs ovs_flow_cmd_new() preallocates the optional reply skb before it takes ovs_mutex and before it knows which existing flow will be updated. That is normally fine because the skb is sized from the request flow identifier. That identifier also becomes the inserted flow's identifier. For updates, however, a request with a UFID may miss the UFID lookup and then fall back to the flow key lookup. That lookup can legitimately find an existing key-identified flow. UFIDs are optional and the flow key is the primary identifier. For echoed replies, ovs_flow_cmd_fill_info() writes the matched flow's identifier, not the request identifier used for the preallocation. A short request UFID can therefore leave too little room for the key identifier. The fill can then fail with -EMSGSIZE and hit the BUG_ON(error < 0) in the update path. Once the update target has been resolved, reallocate the reply skb if the matched flow needs a larger reply than the request identifier allowed. Do this before replacing the actions so the request can still fail cleanly if the rare extra allocation fails.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-09-12
AI Q&A
2026-08-22
EPSS Evaluated
2026-09-10
NVD
CVE-2026-74664
EUVD
EUVD-2026-64351

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux_kernel openvswitch *
openvswitch openvswitch *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel's Open vSwitch (OVS) module involves a flaw in how flow update replies are handled. When updating an existing flow, the system preallocates a reply buffer based on the request's flow identifier. However, if the update falls back to a key-based lookup and finds a different flow, the reply buffer may be too small. This can cause the reply to fail with an error, triggering a kernel bug check (BUG_ON). The fix ensures the reply buffer is reallocated if needed before finalizing the update.

Detection Guidance

This vulnerability is specific to the Linux kernel's Open vSwitch (OVS) implementation and requires kernel-level inspection. Detection involves checking for kernel logs or crashes related to OVS flow updates. Commands like dmesg | grep -i ovs or journalctl -k | grep -i ovs may reveal errors. If the system crashes with a BUG_ON triggered by -EMSGSIZE during OVS flow updates, it may indicate exploitation.

Impact Analysis

This vulnerability could lead to a kernel panic or system crash if exploited, disrupting network services relying on Open vSwitch. Attackers might trigger the bug by sending maliciously crafted flow update requests, causing denial-of-service conditions on affected systems.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel networking issue related to Open vSwitch flow updates that could cause system instability but does not involve data privacy, security controls, or protected health information handling.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-74664. Monitor Open vSwitch logs for errors related to flow updates or reply skb allocation failures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74664. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart