CVE-2026-64531

Status: UPDATED  |  Advisory ID: CVE-2026-64531

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: reject oversized nested action attrs

Open vSwitch stores generated flow actions as nlattrs, whose nla_len

field is u16. Commit a1e64addf3ff ("net: openvswitch: remove

misbehaving actions length check") allowed the total sw_flow_actions

stream to grow beyond 64 KiB, which is valid, but also removed the last

guard preventing a generated nested action attribute from exceeding

U16_MAX.

An oversized generated container can thus be closed with a truncated

nla_len. A later dump or teardown then walks a structurally different

stream than the one that was validated. In particular, an oversized

nested CLONE/CT action may cause subsequent bytes in the generated

stream to be interpreted as independent actions.

Keep the larger total-action-stream behavior, but make nested action

close reject generated containers that do not fit in nla_len, and return

the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and

CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse

construction order before discarding failed wrappers, so resources copied

into the rejected tails are released before the wrappers are removed.

Most failed outer wrappers are discarded by truncating actions_len after

child resources have been released. CHECK_PKT_LEN also trims its parent

after branch resources are gone. SET/TUNNEL close failures unwind their

known tun_dst ownership directly, and SET_TO_MASKED has no external

ownership and truncates on close failure. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References