What is the CVSS score of EUVD-2026-59658?

EUVD-2026-59658 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-59658?

Within 24 hours: inventory Linux systems with OVS deployments to identify which use custom userspace applications via Netlink interfaces, as standard ovs-vswitchd configurations present no risk. Within 7 days: apply available kernel patches from your Linux distribution's stable releases to all identified affected systems and validate in staging environments. Within 30 days: complete production rollout of patches with verification that OVS meter subsystem functionality remains intact.

Linux Kernel EUVD-2026-59658

Q: Which versions of Linux Kernel are affected by EUVD-2026-59658?

A privilege escalation vulnerability in Linux Open vSwitch (CVE-2026-74465) affects organizations running customized OVS deployments with non-standard userspace applications; standard configurations…. A patch is available.

| CVE-2026-74465 HIGH

2026-08-15 Linux

GHSA-qwfg-529h-q8w8

Information Disclosure Linux Trend Micro

7.8

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Gain local access with CAP_NET_ADMIN
Delivery

Open Netlink socket to OVS datapath
Exploit

Send crafted OVS_METER_CMD_SET to trigger attach_meter() failure
Install

kfree() called on RCU-visible meter without synchronize_rcu()
C2

Concurrently send OVS_PACKET_CMD_EXECUTE referencing freed meter
Execute

Trigger UAF read/write in ovs_meter_execute()
Impact

Achieve privilege escalation or memory disclosure

Vulnerability Assessment

Exploitation Conditions	Requires local system access and the CAP_NET_ADMIN capability (or equivalent) within the applicable network namespace to send Netlink commands to the OVS datapath. The vulnerable code path is triggered only when a custom application uses the OVS uAPI directly and crafts a meter set command that causes `attach_meter()` to fail after the meter has been inserted into the hash table. Standard ovs-vswitchd deployments are explicitly not vulnerable because vswitchd always creates meters before flows that reference them, preventing the specific failure scenario. Exploitation also requires a concurrent kernel path reading the freed meter (e.g., a packet exec command), introducing a timing dependency. Limiting factors: local access only (AV:L), elevated network capability required, non-default code path (custom uAPI application), and the race between free and concurrent read must be won.
Impact	The NVD-assigned CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates accessibility: OVS Netlink meter commands require CAP_NET_ADMIN, which is a privileged capability - PR:L is debatable and PR:H is arguably more accurate on hardened systems. EPSS of 0.17% at the 6th percentile indicates that automated or widespread exploitation is not currently anticipated by the threat intelligence community. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept code has been identified. The real-world attack surface is further narrowed by the requirement for a custom application using uAPI rather than standard ovs-vswitchd. However, the bug's discovery by a professional ZDI researcher and the KASAN-confirmed crash trace suggest it is a genuine, exploitable code path rather than a theoretical flaw. For systems running OVS with untrusted local users or in container environments with elevated network capabilities, risk escalates materially. Patch availability across all active stable branches reduces urgency for systems with a regular patching cadence.
Exploit ScenarioDerived	A local attacker with CAP_NET_ADMIN capability writes a custom Netlink application that issues an OVS_METER_CMD_SET command crafted to trigger an attach failure in `attach_meter()` - causing the meter to be briefly published to the RCU-protected hash table and then freed via `kfree()`. Concurrently, the attacker dispatches a packet via OVS_PACKET_CMD_EXECUTE that matches a flow referencing the now-freed meter, causing `ovs_meter_execute()` to dereference the dangling pointer and achieve a slab-use-after-free read/write primitive. No public proof-of-concept exploit exists, but the KASAN trace in the bug report provides a clear reproduction blueprint.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 17, 2026

Use-after-free in the Linux kernel's Open vSwitch meter subsystem exposes systems running OVS to local privilege escalation, memory corruption, and potential information disclosure. The flaw affects all Linux 5.8+ kernels up to the patched stable releases and is triggered by a custom userspace application interacting with OVS via Netlink uAPI - standard ovs-vswitchd deployments are not vulnerable. No public exploit has been identified and EPSS sits at the 6th percentile, but the bug was discovered by Trend Micro's Zero Day Initiative (ZDI-CAN-31642), indicating professional security research attention; multiple stable kernel patches are now available.

RemediationAI

Upgrade the Linux kernel to a patched stable release: 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6, applying the corresponding fix commits from https://git.kernel.org/stable/c/0310d1fa7f9debd0d89629e9f14c7975a47eaa9a and related commits. Distributions carrying their own stable kernel branches should apply the upstream fix to their packaging. As a compensating control where immediate patching is not feasible, restrict access to OVS Netlink operations by ensuring that only trusted, well-tested userspace processes (e.g., ovs-vswitchd) hold CAP_NET_ADMIN in the relevant network namespace; removing this capability from untrusted or containerized workloads eliminates the attack surface. Disabling the OVS kernel module (modprobe -r openvswitch) is effective but causes a complete service outage on affected OVS deployments.

Affected VersionsENISA

Linux patch: 6.6.151

Linux c7c4c44c9a95d87e50ced38f7480e779cb472174 <4d03e5fa3fbb1df15258a1eb3d6963f0d65659b3

Linux c7c4c44c9a95d87e50ced38f7480e779cb472174 <90623c9499627803ef3f04fa25a3199402d4fb95

Linux patch: 7.2-rc6

Linux patch: 7.1.8

Linux c7c4c44c9a95d87e50ced38f7480e779cb472174 <a58a2b0ce354df531ebc71fc870058c2feb59f6b

Linux c7c4c44c9a95d87e50ced38f7480e779cb472174 <431a295d93f76fbdb6a7cfce92a9e3dfee1e5d61

Linux patch: 0

Linux patch: 6.18.44

Linux c7c4c44c9a95d87e50ced38f7480e779cb472174 <0310d1fa7f9debd0d89629e9f14c7975a47eaa9a

Linux 5.8

Linux patch: 6.12.103

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The Open vSwitch (OVS) subsystem in the Linux kernel implements per-flow traffic metering. The vulnerability originates in a RCU (Read-Copy-Update) synchronization error in the meter attachment path. Specifically, attach_meter() inserts a newly allocated meter into the hash table - making it visible to all CPUs - before completing all validation checks. If any subsequent check fails, the function detaches the meter and returns an error. The caller ovs_meter_cmd_set() interprets this as meaning the meter was never published and calls kfree() directly, without invoking synchronize_rcu() or equivalent to wait for existing RCU readers to finish. Any concurrent CPU executing ovs_meter_execute() that dereferences the now-freed meter pointer triggers a slab-use-after-free. The CWE is a use-after-free (CWE-416). CPE data identifies the affected product as cpe:2.3:a:linux:linux:* introduced at commit c7c4c44c9a95d87e50ced38f7480e779cb472174 (Linux 5.8). The fix defers hash table insertion in attach_meter() until all checks have passed and failure is no longer possible.

Know when Trend Micro gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 6.7 MEDIUM

OVS Netlink meter commands require CAP_NET_ADMIN (PR:H); UAF on freed meter achieves full kernel-memory C/I/A impact with no user interaction needed.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix potential UAF on meter attach failure

While attaching a newly created meter attach_meter() function makes the new meter visible to other CPUs but can still fail afterwards. On failure, it detaches the meter back and returns an error.

However, this is an unexpected behavior for the ovs_meter_cmd_set() that uses a plain kfree(meter) on attach failure without waiting for RCU readers to stop using it, assuming it was never visible.

This is never a problem for ovs-vswitchd as it always creates meters before creating any flows that use them. But the UAF can be triggered with a custom application using uAPI:

BUG: KASAN: slab-use-after-free in ovs_meter_execute (net/openvswitch/meter.c:653) Read of size 8 at addr ffff88810d152650 by task meter/2508

Call Trace: ovs_meter_execute (net/openvswitch/meter.c:653) do_execute_actions (net/openvswitch/actions.c:1407) ovs_execute_actions (net/openvswitch/actions.c:1584) ovs_packet_cmd_execute (net/openvswitch/datapath.c:703) ... netlink_sendmsg (af_netlink.c:1900)

Allocated by task 2519: __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415) ovs_meter_cmd_set (net/openvswitch/meter.c:422) ... netlink_sendmsg (af_netlink.c:1900)

Freed by task 2519: kfree (mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720) ovs_meter_cmd_set (net/openvswitch/meter.c:479) ... netlink_sendmsg (af_netlink.c:1900)

Fix that by making sure attach_meter() doesn't make the meter visible until all the checks are done and the function can't fail anymore.

This also makes sure the "hash" value is calculated after the potential re-sizing of the table.

Reported by Trend Micro's Zero Day Initiative as ZDI-CAN-31642.

Zero Day Initiative Advisories

ZDI-26-688 Linux Kernel OpenvSwitch Race Condition Local Privilege Escalation Vulnerability Sep 2026

Executive ViewAI

Why It Matters

A privilege escalation vulnerability in Linux Open vSwitch (CVE-2026-74465) affects organizations running customized OVS deployments with non-standard userspace applications; standard configurations are unaffected. Patches are available, but remediation requires identifying affected systems within your infrastructure to prevent potential unauthorized system access.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 94% exploitable

Prevalence

High

Linux kernel broadly deployed; OVS present in many cloud and SDN environments

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Trend Micro

View all

CVE-2016-7552 CRITICAL Emergency POC

9.8 Apr 12

On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows

CVE-2016-7547 CRITICAL Emergency POC

9.8 Apr 12

A command execution flaw on the Trend Micro Threat Discovery Appliance 2.6.1062r1 exists with the timezone parameter in

CVE-2017-11394 CRITICAL Act Now POC

9.8 Aug 03

Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitr

CVE-2017-11391 HIGH Act Now POC

8.8 Aug 03

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote att

CVE-2017-11392 HIGH Act Now POC

8.8 Aug 03

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote att

CVE-2016-6267 HIGH Act Now POC

8.8 Jan 30

SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330

CVE-2017-6398 HIGH Act Now POC

8.8 Mar 14

An issue was discovered in Trend Micro InterScan Messaging Security (Virtual Appliance) 9.1-1600. Rated high severity (C

CVE-2017-7896 MEDIUM This Month POC

6.1 Apr 18

Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 before CP 1644 has XSS. Rated medium severity (CV

CVE-2017-14078 CRITICAL Act Now

9.8 Sep 22

SQL Injection vulnerabilities in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attac

CVE-2016-3987 CRITICAL Emergency POC

9.8 Apr 12

The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url para

CVE-2012-1461 MEDIUM This Month

4.3 Mar 21

The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5

CVE-2012-1459 MEDIUM This Month

4.3 Mar 21

The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back