CVE-2026-74464
net: openvswitch: fix skb leak on flow key update failure during ct
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix skb leak on flow key update failure during ct ovs_ct_execute() always steals or frees the skb on failure while ovs_flow_key_update() does not. So, if it fails and we return right away, the skb ends up leaked. Fix that by breaking instead and letting the common error handling code at the bottom of the loop to free the skb properly. This is a very unlikely scenario as it requires the packet to become unparseable by applying a set of actions on a previously parseable skb, but should be fixed nevertheless. Reported by Sashiko.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
Version range not reported
- Linux Linux
4.3
References 8
git.kernel.org
- stable/c/b77126b2915900f69f9fcf5d624a77c8e6d50c31
- stable/c/6cc523eaee72c4e91894136cff64946ae9de2cda
- stable/c/22e0ca88090d89c128078062186b03bb5fdc4f98
- stable/c/736e972f3f8a304158345223ac6e816166a467ce
- stable/c/e84dfaac50aab45ad8c670da43e3aa1f97bd2a41
- stable/c/e0ba8eaef2a0d02a7a485e6a7157e47272b65cea
- stable/c/393f3c72600ab6721d732a0ab245bc896c5b28fc
- stable/c/bc62e843bc48f933da765ce47079fd992e535794