Look up another CVE · open CVE-2026-89488 in the interactive tracker
CVE-2026-89488
openvswitch: Fix CT limit teardown use-after-free
Published 2026-09-11 (37 days ago) by the Linux kernel CNA. Subsystem net/openvswitch. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-89488 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovs_mutex. The CT limit pointer was neither removed from readers nor protected by a grace period, allowing packet processing to dereference the freed state. An unprivileged user can trigger this bug from a user and network namespace, causing a slab-use-after-free in ovs_ct_execute() when the netns is torn down. Publish the CT limit pointer through RCU, remove it before teardown, and wait for readers before freeing its contents. Keep ovs_mutex around individual CT limit updates, and use the RCU read-side lock while GET traverses the RCU-protected limit lists. Netns teardown detaches the RCU-protected CT limit state in the pernet .pre_exit callback while holding ovs_mutex. The pernet core guarantees an RCU grace period between the .pre_exit and .exit callbacks, so the .exit callback completes the teardown without adding any extra synchronization. The netlink command handlers do not need NULL checks because the userspace netlink socket holds an active reference to its network namespace while a request is processed. The per-netns exit path therefore cannot run concurrently with SET, DEL, or GET for that socket's namespace.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/openvswitch/conntrack.c
net/openvswitch/conntrack.h
net/openvswitch/datapath.c
net/openvswitch/datapath.h
- What this is
- OPENVSWITCHMAINTAINERS section matched on net/openvswitch/ · netdev@vger.kernel.org · Maintained
- Kernel module
- openvswitch
Check it on the machine
grep -w CONFIG_OPENVSWITCH /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w openvswitchPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sid, bookworm · linux-6.12m
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switch
- CONFIG_OPENVSWITCH
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-11 (37 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.0% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/openvswitch
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.18 | 5.10.270 | 239f26589a69 |
| 4.18 | 5.15.221 | 3b9369881b40 |
| 4.18 | 6.1.188 | 3b41d907400c |
| 4.18 | 6.6.157 | 680f20d5937f |
| 4.18 | 6.12.110 | bf4aaa7ea257 |
| 4.18 | 6.18.51 | e15407c3a8a0 |
| 4.18 | 7.2.4 | 6a6d36fadb85 |
| 4.18 | 7.3 | 403f96c32c9e |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The UAF is reached from the OVS datapath CT commit path (ovs_ct_execute/ovs_ct_check_limit) while the attacker's netns is torn down. Setup uses local genetlink (datapath, CT flow, CT_LIMIT SET) and packet injection via a vport (veth/TUN/internal) or OVS_PACKET_CMD_EXECUTE; this is not a remotely triggered protocol parser.
- AC:LAttack complexity, low
- The attacker controls both sides of the race: they enable CT limits, install a CT-commit flow, inject packets so ovs_ct_check_limit runs under RCU, and destroy the netns so ovs_ct_limit_exit kfree()s the same object without a grace period. Success does not depend on victim-only timing.
- PR:LPrivileges required, low
- OVS genetlink families are netnsok and use GENL_UNS_ADMIN_PERM, so CAP_NET_ADMIN is checked in the socket's user namespace (unshare -Urn). The fix commit states an unprivileged user can trigger the slab-use-after-free from a user and network namespace.
- UI:NUser interaction, none
- Exploitation needs only the attacker's own netlink setup, packet injection, and netns teardown. No victim action such as mounting a filesystem, opening a file, or clicking a prompt is required.
- S:UScope, unchanged
- This is kernel slab use-after-free in the host Open vSwitch datapath. Impact stays in the same kernel security authority and is not a VM escape, IOMMU/DMA bypass, or other cross-boundary compromise.
- C:HConfidentiality impact, high
- ovs_ct_check_limit/ct_limit_get dereference freed ovs_ct_limit_info and walk its kmalloc'd limits hlist after ovs_ct_limit_exit kfree()s them, a slab UAF that can be reclaimed and used for arbitrary kernel reads.
- I:HIntegrity impact, high
- With a finite zone limit, nf_conncount_count_skb() inserts into nf_conncount_data after nf_conncount_destroy(); combined with UAF of the limits table this is a write-after-free/heap primitive that can be turned into arbitrary write or control-flow hijack.
- A:HAvailability impact, high
- The commit reports a slab-use-after-free in ovs_ct_execute() on netns teardown. UAF of CT-limit and conncount objects can oops/panic the kernel even when not fully exploited for code execution.