CVE-2026-97611

Received Received - Intake

Use-After-Free in Linux Kernel Open vSwitch

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix use-after-free of the flow table mask array tbl_mask_array_realloc() retires the old mask_array before it stops being reachable: old = ovsl_dereference(tbl->mask_array); if (old) { ... call_rcu(&old->rcu, mask_array_rcu_cb); } rcu_assign_pointer(tbl->mask_array, new); call_rcu() only waits for read-side critical sections already in flight. tbl->mask_array still points at old between the call_rcu() and the rcu_assign_pointer(), so a reader entering ovs_flow_tbl_lookup_stats() in that window picks up old in a fresh critical section that the pending grace period does not cover. tbl_mask_array_realloc() runs in process context under ovs_mutex, so the window is preemptible and can outlast the grace period. Then mask_array_rcu_cb() frees old before the swap runs: BUG: KASAN: slab-use-after-free in flow_lookup.constprop.0+0x2bf/0x2f0 Read of size 8 at addr ffff888020b3e018 by task poc/741 flow_lookup.constprop.0+0x2bf/0x2f0 ovs_flow_tbl_lookup_stats+0x4a3/0x5c0 ovs_dp_process_packet+0x19c/0x710 ovs_vport_receive+0x243/0x390 internal_dev_xmit+0x81/0x170 Freed by task 728: kfree+0x16a/0x4e0 rcu_core+0x853/0x1030 Publish the new array before retiring the old one. The kfree_rcu() that call_rcu() replaced ran after the swap.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97611

EUVD

EUVD-2026-86742

Affected Vendors & Products

Vendor	Product	Version / Range
openvswitch	openvswitch	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's Open vSwitch module. It occurs when the flow table mask array is reallocated. The old array is retired with call_rcu before the new array is published, creating a window where readers can still access the old array while it is being freed. This leads to a use-after-free condition when the old array is accessed after being freed.

Detection Guidance

This vulnerability is specific to the Linux kernel's Open vSwitch implementation and involves a use-after-free condition in the flow table mask array. Detection requires checking kernel logs for KASAN reports or slab-use-after-free errors related to Open vSwitch. Monitor system logs for errors like 'BUG: KASAN: slab-use-after-free in flow_lookup' or similar traces. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

This vulnerability can cause system crashes, kernel panics, or arbitrary code execution with kernel privileges. Attackers could exploit it to gain control over the affected system, leading to data breaches, service disruptions, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's Open vSwitch module, which could lead to memory corruption and potential arbitrary code execution. While it does not directly impact data privacy or security controls required by GDPR or HIPAA, it could compromise system integrity, potentially leading to unauthorized access or data breaches if exploited. Compliance with these regulations often requires maintaining secure and stable systems to protect sensitive data.

Mitigation Strategies

Apply the kernel patch that resolves this issue. Update Open vSwitch to the latest stable version that includes the fix. Restart services dependent on Open vSwitch to ensure the patched kernel is active. Monitor for any recurrence of the use-after-free errors in logs.

Hi! I’m here to help you understand CVE-2026-97611. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70