EUVD-2026-93179
GHSA-6vh8-2x3v-qcxv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access on OVS conntrack host
-
DeliveryDrive concurrent label ops on confirmed conntrack
-
ExploitTrigger lockless extension reallocation (use-after-free)
-
ExecutionCorrupt freed kernel memory
-
ImpactEscalate privileges or crash host
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the host to run Open vSwitch with connection tracking (OVS CT) AND the conntrack labels feature in use, so that ovs_ct_get_conn_labels() is exercised; the flaw specifically affects CONFIRMED conntrack entries, which are read locklessly across CPUs, so the attacker must induce a label operation on a confirmed connection concurrently with another CPU's lockless read. Limiting factors that reduce realistic risk: local access only (no remote/network vector per AV:L), the OVS+conntrack+labels datapath must be configured and actively processing traffic (not a default on general-purpose Linux installs), and success depends on winning a narrow timing race window (reallocation vs. concurrent read), making reliable exploitation difficult. |
| Impact | Signals converge on this being a genuine but non-urgent, patch-in-routine-cadence memory-safety bug rather than a top-priority emergency. The 7.8 'High' CVSS is driven entirely by the impact triad (C:H/I:H/A:H) typical of any kernel use-after-free, not by exploitability: the vector is AV:L (local only) with PR:L (some privilege required) and no network exposure, so the headline score overstates reachability. EPSS is very low at 0.18% (7th percentile), there is NO CISA KEV listing, and no public exploit was identified in the provided data - three independent low-urgency signals that agree with each other. One internal tension to flag: NVD scored AC:L, but the root cause is a classic lockless reallocation race (an extension block freed on one CPU while another CPU reads it), which in practice is timing-dependent and closer to AC:H - this likely inflates the base score, and I score it AC:H in my independent assessment. Also note the affected 'product' per CPE is the Linux kernel generically, but the vulnerable code path is Open vSwitch connection tracking with labels, so exposure is far narrower than 'all Linux hosts.' Net: a real local privilege-escalation/DoS-class memory bug worth patching in normal kernel update windows, not drop-everything. |
| Exploit ScenarioDerived | On a host running Open vSwitch with connection tracking and conntrack labels enabled (common in cloud/SDN/virtualization datapaths), a local attacker drives concurrent conntrack label operations against an already-confirmed connection; because confirmed entries are read locklessly, ovs_ct_get_conn_labels() reallocating the labels extension frees the block while another CPU dereferences it, producing a use-after-free. This can corrupt kernel memory for local privilege escalation or crash the host (DoS). No public proof-of-concept exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
A race condition in the Linux kernel's Open vSwitch conntrack label handling lets a local user trigger a read of a reallocated-and-freed conntrack extension block, which can leak kernel memory or corrupt state in the OVS datapath. ovs_ct_get_conn_labels() added a label extension even to already-confirmed conntrack entries, so a lockless reader on another CPU could dereference storage that was freed underneath it; the fix restricts extension insertion to unconfirmed conntracks and makes a label operation on a label-less confirmed conntrack fail instead. The flaw exists in kernels carrying the OVS conntrack labels feature (introduced around Linux 4.3) and is fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4. Exploitation is local and authenticated (CVSS:3.1/AV:L/AC:H/PR:L/UI:N per the independent assessment), requires OVS with connection tracking and labels actively configured, and depends on winning a narrow timing window; EPSS is 0.18% (7th percentile) and there is no CISA KEV entry or public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: Linux 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4 (mainline fix lineage from c2ac667358708d7cce64c78f58af6adf4c1e848b; per-branch stable commits are linked in the references at git.kernel.org). Update the kernel to the branch-appropriate fixed version or apply the corresponding stable commit, and prefer your distribution's kernel package once it carries that version; reboot is required since the change is in core networking code. If immediate patching is not possible, the most effective compensating control is to stop exercising the vulnerable path: do not use OVS conntrack label matching/actions (ct_label / CT label fields) in datapath flows - this removes the trigger condition but also disables label-based policy and any workflow that depends on per-connection labels, and it must be done everywhere OVS is deployed, including controllers that program those flows. Restricting interactive/local access to OVS hosts (no untrusted local users, tightened shell access, and removing unprivileged OVS tooling) reduces the likelihood of a local attacker reaching the datapath, but does not address the underlying memory-safety bug and carries the operational cost of reduced multi-tenant flexibility. Note that no public exploit code and no CISA KEV listing were identified at time of analysis, so these measures are precautionary rather than incident-response driven.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Open vSwitch's datapath integrates with the kernel netfilter conntrack (nf_conntrack) subsystem to implement stateful flows, and the ct_label feature stores per-connection metadata in a conntrack 'extension' - an optional, separately allocated block chained off the conntrack object. Because confirmed conntrack entries are considered immutable and are read locklessly (RCU-style) by other CPUs, mutating them is unsafe. ovs_ct_get_conn_labels() violated that contract: when a conntrack lacked a labels extension it would allocate and attach one, and for a confirmed entry this could reallocate/free the extension block while a concurrent CPU was walking or reading the same structure - a classic time-of-check/time-of-use, use-after-free read class (a CWE was not formally assigned in the source data, but the pattern is concurrent access to freed memory). The upstream change keys the extension addition on conntrack confirmation status and returns a failure to the caller's label operation for confirmed, label-less entries, eliminating the write to shared confirmed state. Affected code is identified by CPE cpe:2.3:a:linux:linux (two entries in the input), with the mainline baseline commit c2ac667358708d7cce64c78f58af6adf4c1e848b and per-branch fix commits 2e6dd889..., 3f118c82..., 05eab8dc..., 4371d79e..., 579d87ec..., 8c9fcc6c..., d16f089b... and 7ff688ac....
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lockless reallocation race is timing-dependent (AC:H) and requires local ability to drive conntrack label ops (AV:L/PR:L); use-after-free yields full kernel memory compromise (C/I/A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
openvswitch: avoid reallocating confirmed conntrack labels
ovs_ct_get_conn_labels() adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read locklessly, so adding an extension may reallocate and free the extension block while another CPU accesses it.
Only add the extension for unconfirmed conntracks. A confirmed conntrack without labels now fails the caller's label operation instead of reallocating its extension storage.
Executive ViewAI
A race condition in the Linux kernel's Open vSwitch connection-tracking label handling affects hosts running OVS with conntrack labels enabled, allowing a local authenticated user to read freed kernel memory or corrupt datapath state. Because the flaw sits in the shared kernel, multi-tenant hypervisors, container platforms and virtualized network fabrics inherit the exposure, and kernel memory disclosure can erode the isolation boundaries those platforms depend on. Exploitation requires local access, an actively configured OVS conntrack-labels deployment and a narrow timing window, but vendor fixes are already published and should be prioritized for internet-facing and multi-tenant systems.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB