HIGH Introduced in 5.9
openvswitch MaskArray UAF
CVE-2026-97611
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix use-after-free of the flow table mask array tbl_mask_array_realloc() retires the old mask_array before it stops being reachable: old = ovsl_dereference(tbl->mask_array); if (old) { ... call_rcu(&old->rcu, mask_array_rcu_cb); } rcu_assign_pointer(tbl->mask_array, new); call_rcu() only waits for read-side critical sections already in flight. tbl->mask_array still points at old between the call_rcu() and the rcu_assign_pointer(), so a reader entering ovs_flow_tbl_lookup_stats() in that window picks up old in a fresh critical section that the pending grace period does not cover. tbl_mask_array_realloc() runs in process context under ovs_mutex, so the window is preemptible and can outlast the grace period. Then mask_array_rcu_cb() frees old before the swap runs: BUG: KASAN: slab-use-after-free in flow_lookup.constprop.0+0x2bf/0x2f0 Read of size 8 at addr ffff888020b3e018 by task poc/741 flow_lookup.constprop.0+0x2bf/0x2f0 ovs_flow_tbl_lookup_stats+0x4a3/0x5c0 ovs_dp_process_packet+0x19c/0x710 ovs_vport_receive+0x243/0x390 internal_dev_xmit+0x81/0x170 Freed by task 728: kfree+0x16a/0x4e0 rcu_core+0x853/0x1030 Publish the new array before retiring the old one. The kfree_rcu() that call_rcu() replaced ran after the swap.
02KernelScan AI Analysis
Risk summary
A use-after-free in the Open vSwitch flow table mask array can be triggered when packets traverse an OVS datapath during a periodic mask rebalance. Any process, container, or VM with network access to the bridge can exploit the race to corrupt kernel memory, potentially leading to container escape or a kernel crash. The bug requires Open vSwitch to be configured and active but needs no special privileges beyond network access.
Vulnerability analysis
The Open vSwitch flow table periodically rebalances its mask array based on usage statistics. During reallocation, the old array was scheduled for deferred freeing before the replacement pointer was published, opening a window where a concurrent packet-processing thread could read the freed array. The fix publishes the new array first and only then schedules the old one for deferred freeing, ensuring no reader can observe a stale pointer. The vulnerable path is the normal packet forwarding path through an OVS datapath, so any process, container, or virtual machine with access to an OVS bridge can trigger it by sending traffic during the periodic mask rebalance; no special privileges beyond network access to the bridge are needed.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.9 | 5.10.271 | 4c98b492e9ed |
| 5.15 | 5.9 | 5.15.222 | 4016ead17acd |
| 6.1 | 5.9 | 6.1.189 | 017dbbf0d6c3 |
| 6.6 | 5.9 | 6.6.158 | 76678217cdab |
| 6.12 | 5.9 | 6.12.111 | cd982e11684d |
| 6.18 | 5.9 | 6.18.53 | a0d18d21d48a |
| 7.2 | 5.9 | 7.2.7 | 035e9c372206 |
| mainline | 5.9 | 7.3-rc3 | ba4ba11ed6eb |
| cip/6.12 | 5.9 | 6.12.111-cip32 | cd982e11684d |