EUVD-2026-64388
GHSA-6727-4wmg-w3rc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector because TUN fd access is required; PR:L since unprivileged users with tun group membership can trigger it; C/I/A:H consistent with kernel BUG enabling crash or memory corruption.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net/openvswitch: check Ethernet header length in key_extract()
When a packet arrives on an ARPHRD_NONE device (e.g. TUN), ovs_flow_key_extract() trusts the user-provided skb->protocol field: if it is ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and key_extract() is called without ensuring the skb has ETH_HLEN (14) bytes of linear data. key_extract() unconditionally pulls 2 * ETH_ALEN bytes for MAC addresses and parse_ethertype() pulls 2 more, either of which triggers a kernel BUG in __skb_pull() when the linear area is too small.
kernel BUG at include/linux/skbuff.h:2848! RIP: 0010:key_extract+0xa7e/0xd90 net/openvswitch/flow.c:933 ovs_flow_key_extract+0x419/0xa70 ovs_vport_receive+0x222/0x390 netdev_frame_hook+0x3e0/0x630 tun_get_user+0x2d0c/0x38e0
Fixed by calling check_header() in key_extract() before accessing the Ethernet header.
AnalysisAI
Kernel BUG triggerable in the Open vSwitch (OVS) net subsystem allows a local low-privileged attacker to crash the kernel or potentially escalate privileges by injecting undersized Ethernet frames through a TUN device. Affected kernels from Linux 4.10 onward trust the user-supplied skb->protocol field on ARPHRD_NONE devices without validating that sufficient linear data exists for Ethernet header parsing, causing __skb_pull() to hit an unconditional BUG halt. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following to be simultaneously true: (1) the Open vSwitch kernel module (openvswitch.ko) is loaded and operational; (2) at least one OVS port is backed by an ARPHRD_NONE device - specifically a TUN interface - rather than a physical or VETH interface; (3) the attacker has write access to that TUN file descriptor, which typically requires membership in the 'tun' group, CAP_NET_ADMIN, or access to a container/VM whose network is OVS-TUN backed; (4) the attacker can craft and inject a packet with skb->protocol == ETH_P_TEB and fewer than 14 bytes of linear data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 High, reflecting that a low-privileged local attacker with access to a TUN device and OVS can reliably trigger the condition with no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a local shell account on a Linux host running Open vSwitch opens a TUN file descriptor and configures it as an OVS port. They then write a raw packet to the TUN fd with skb->protocol set to ETH_P_TEB but with fewer than 14 bytes of payload, causing OVS flow key extraction to call __skb_pull() on an undersized linear buffer. … |
| Remediation | Upgrade to the patched kernel for your stable branch: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, or Linux 7.2 mainline. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all production systems running Linux kernel 4.10 or later, with priority flagging for container hosts, Kubernetes nodes, and systems allowing untrusted local user access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today