CVE-2026-89488

Status: UPDATED  |  Advisory ID: CVE-2026-89488

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: Fix CT limit teardown use-after-free

Packet processing uses CT limit state under RCU, while netns teardown

frees that state under ovs_mutex. The CT limit pointer was neither removed

from readers nor protected by a grace period, allowing packet processing to

dereference the freed state.

An unprivileged user can trigger this bug from a user and network

namespace, causing a slab-use-after-free in ovs_ct_execute() when the

netns is torn down.

Publish the CT limit pointer through RCU, remove it before teardown, and

wait for readers before freeing its contents. Keep ovs_mutex around

individual CT limit updates, and use the RCU read-side lock while GET

traverses the RCU-protected limit lists.

Netns teardown detaches the RCU-protected CT limit state in the pernet

.pre_exit callback while holding ovs_mutex. The pernet core guarantees an

RCU grace period between the .pre_exit and .exit callbacks, so the .exit

callback completes the teardown without adding any extra synchronization.

The netlink command handlers do not need NULL checks because the userspace

netlink socket holds an active reference to its network namespace while a

request is processed. The per-netns exit path therefore cannot run

concurrently with SET, DEL, or GET for that socket's namespace. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References