HIGH Introduced in 4.10
openvswitch KeyExtract Panic
CVE-2026-74701
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in key_extract() When a packet arrives on an ARPHRD_NONE device (e.g. TUN), ovs_flow_key_extract() trusts the user-provided skb->protocol field: if it is ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and key_extract() is called without ensuring the skb has ETH_HLEN (14) bytes of linear data. key_extract() unconditionally pulls 2 * ETH_ALEN bytes for MAC addresses and parse_ethertype() pulls 2 more, either of which triggers a kernel BUG in __skb_pull() when the linear area is too small. kernel BUG at include/linux/skbuff.h:2848! RIP: 0010:key_extract+0xa7e/0xd90 net/openvswitch/flow.c:933 ovs_flow_key_extract+0x419/0xa70 ovs_vport_receive+0x222/0x390 netdev_frame_hook+0x3e0/0x630 tun_get_user+0x2d0c/0x38e0 Fixed by calling check_header() in key_extract() before accessing the Ethernet header.
02KernelScan AI Analysis
Risk summary
A local user who can create a TUN device and attach it to an Open vSwitch bridge can crash the kernel by sending a packet shorter than an Ethernet header with a protocol field claiming to be Ethernet. The crash is immediate and repeatable, causing a full system denial of service. On default Linux configurations where user namespaces are enabled, this is reachable by unprivileged users.
Vulnerability analysis
When a packet arrives on a layer-3 tunnel device such as TUN, Open vSwitch trusts the packet's self-declared protocol type. If the protocol field claims the packet is an Ethernet frame but the packet is shorter than a valid Ethernet header, the flow extraction code attempts to read header fields that do not exist, hitting a kernel safety assertion that panics the entire system. The fix adds a length check before any Ethernet header fields are accessed, so undersized packets are rejected with an error instead of crashing the kernel. The vulnerable code path is reachable by any local user who can create a TUN device and attach it to an OVS bridge — a capability obtainable through user namespaces on default configurations, making it accessible to unprivileged users.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.10 | 5.10.265 | e85278afd489 |
| 5.15 | 4.10 | 5.15.216 | 81f9b09f0ea3 |
| 6.1 | 4.10 | 6.1.183 | 831471718f6e |
| 6.12 | 4.10 | 6.12.104 | 0b60b55652ba |
| 6.18 | 4.10 | 6.18.45 | a8139285c892 |
| 6.6 | 4.10 | 6.6.152 | d8bea341b183 |
| 7.1 | 4.10 | 7.1.9 | 9b8cfbb58b85 |
| mainline | 4.10 | 7.2 | cf6f8b29befb |
| cip/4.19 | 4.10 | 4.19.325-cip136 | cbd7ea5fcde4 |
| cip/4.19-rt | 4.10 | 4.19.325-cip136-rt50 | cbd7ea5fcde4 |
| cip/5.10 | 4.10 | 5.10.268-cip77 | e85278afd489 |
| cip/5.10-rt | 4.10 | 5.10.268-cip77-rt34 | e85278afd489 |
| cip/6.1 | 4.10 | 6.1.187-cip60 | 831471718f6e |
| cip/6.1-rt | 4.10 | 6.1.189-cip61-rt32 | 831471718f6e |
| cip/6.12 | 4.10 | 6.12.104-cip30 | 0b60b55652ba |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.104-cip30 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.268-cip77 |
| cip/5.10-rt | Fixed in 5.10.268-cip77-rt34 |
| cip/4.19 | Fixed in 4.19.325-cip136 |
| cip/4.19-rt | Fixed in 4.19.325-cip136-rt50 |