EUVD-2026-39318
GHSA-mp79-8qq6-qp9g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local access with low privileges needed to reach OVS code path; only outcome is kernel panic (A:H), with zero confidentiality or integrity impact.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: fix possible kfree_skb of ERR_PTR
After the patch in the "Fixes" tag, the allocation of the "reply" skb can happen either before or after locking the ovs_mutex.
However, error cleanups still follow the classical reversed order, assuming "reply" is allocated before locking: it is freed after unlocking.
If "reply" allocation happens after locking the mutex and it fails, "reply" is left with an ERR_PTR, and execution jumps to the correspondent cleanup stage which will try to free an invalid pointer.
Fix this by setting the pointer to NULL after having saved its error value.
AnalysisAI
Invalid pointer free in the Linux kernel's Open vSwitch (OVS) subsystem allows a local low-privileged user to crash the kernel, resulting in denial of service. The net/openvswitch reply skb cleanup code incorrectly assumes allocation always occurs before mutex acquisition; when allocation fails after locking, an ERR_PTR is passed to kfree_skb(), triggering a kernel panic on any host with OVS active. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The openvswitch kernel module must be loaded and actively processing traffic - this is a non-default configuration present primarily on virtualization hosts, SDN nodes, and cloud infrastructure running OpenStack, Kubernetes with OVS-CNI, or similar platforms. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5) accurately reflects the local, low-privilege, deterministic nature of this denial-of-service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with a standard shell account on a Linux host running OVS-based networking crafts or triggers a condition where an OVS reply skb allocation fails after the ovs_mutex has already been acquired, causing the cleanup path to invoke kfree_skb() on an ERR_PTR value. The resulting kernel panic crashes the host, denying service to all workloads running on it - particularly impactful on shared hypervisors or container hosts where multiple tenants are co-located. … |
| Remediation | Update the Linux kernel to a patched stable release: 5.10.259 or later on the 5.10.x LTS branch, 5.15.210 or later on 5.15.x, 6.1.176 or later on 6.1.x, 6.6.143 or later on 6.6.x, 6.12.94 or later on 6.12.x, 6.18.36 or later on 6.18.x, 7.0.13 or later on 7.0.x, or 7.1 release for the 7.1.x line. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-401 – Memory Leak
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today