Open vSwitch EUVD-2026-86742

Requires a host actively running the in-kernel Open vSwitch datapath (net/openvswitch) with flows being processed; the bug is not reachable on systems that do not load and use OVS. The attacker needs local access with CAP_NET_ADMIN to reconfigure the flow table (adding/removing masks) so that tbl_mask_array_realloc() runs, and must concurrently drive packets through the datapath to hit ovs_flow_tbl_lookup_stats() during the preemptible RCU window between call_rcu() and rcu_assign_pointer(). Limiting factors: exploitation is a timing race (must land inside a narrow window), requires network-admin capability, and yields a kernel crash rather than reliable disclosure or code execution - making stable exploitation difficult and impact primarily denial of service.

This is a CWE-416 use-after-free arising from an RCU publish-order race in the Linux kernel's Open vSwitch (openvswitch) datapath flow table. The NVD CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) rates confidentiality and integrity as High, but the described bug is a data-path READ of a freed mask array (KASAN slab-use-after-free, 8-byte read in flow_lookup/ovs_flow_tbl_lookup_stats) - this is overwhelmingly a crash/DoS (availability) primitive, not confirmed information disclosure or code execution. The AC:L rating is also questionable: exploitation depends on winning a preemptible RCU race window between call_rcu() and rcu_assign_pointer() while packets traverse the datapath, which is a timing-dependent condition better modeled as AC:H. No EPSS score, no CISA KEV listing, and no public exploit are present; only a KASAN reproducer ('poc/741') is referenced in the description. SSVC data is not provided. Net assessment: real severity is closer to a medium local DoS (~5.0) requiring CAP_NET_ADMIN and an OVS-configured host - the headline 7.8 with C:H/I:H overstates real-world impact. The 'Information Disclosure' tag conflicts with the actual UAF/DoS nature and should be treated as mislabeled.

On a host running the Open vSwitch kernel datapath, a local attacker with CAP_NET_ADMIN repeatedly reconfigures flows via netlink to force tbl_mask_array_realloc() while simultaneously driving traffic through the OVS datapath. If a packet-processing reader enters ovs_flow_tbl_lookup_stats() during the narrow window after the old mask array is retired via call_rcu() but before the new pointer is published, it dereferences the freed array, causing a use-after-free and kernel crash. Only a KASAN reproducer is referenced; no weaponized public exploit exists.