CVE-2026-64531: Linux Kernel Open vSwitch DoS Vulnerability

CVE-2026-64531 Overview

CVE-2026-64531 is a Linux kernel vulnerability in the Open vSwitch (OVS) subsystem. Open vSwitch stores generated flow actions as netlink attributes (nlattr), whose nla_len field is a 16-bit unsigned integer. A prior commit removed the last guard preventing a generated nested action attribute from exceeding U16_MAX, allowing an oversized container to be closed with a truncated nla_len. A later dump or teardown then walks a structurally different attribute stream than the one that was validated. Attackers with local privileges to interact with OVS can trigger memory corruption paths in the kernel.

Critical Impact
A local user with the ability to configure OVS flows can cause bytes in the generated stream to be reinterpreted as independent actions, leading to kernel memory corruption and potential privilege escalation.

Affected Products

Linux kernel versions containing commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check")
Open vSwitch kernel datapath (net/openvswitch)
Distributions shipping affected stable kernel trees prior to the fix commits

Discovery Timeline

2026-07-27 - CVE-2026-64531 published to NVD
2026-07-28 - Disclosure posted to the OpenWall OSS-Security mailing list
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64531

Vulnerability Analysis

The vulnerability resides in the Open vSwitch flow action construction path in the Linux kernel networking stack. Open vSwitch encodes actions as nested netlink attributes. Each attribute header carries a nla_len length field limited to 16 bits, capping any single attribute at 65535 bytes.

An earlier fix (a1e64addf3ff) intentionally allowed the total sw_flow_actions stream to exceed 64 KiB, which is a valid design choice. That change also removed the check that ensured each generated nested attribute stayed within U16_MAX. As a result, when the kernel closes an oversized nested container such as OVS_ACTION_ATTR_CLONE, OVS_ACTION_ATTR_CT, OVS_ACTION_ATTR_SAMPLE, OVS_ACTION_ATTR_DEC_TTL, or OVS_ACTION_ATTR_CHECK_PKT_LEN, the length field wraps and stores a truncated value.

Validation walks the pre-close stream and accepts it. Subsequent operations, such as flow dump or teardown, walk the post-close stream using the truncated nla_len and encounter a different structure. Bytes that were intended to be nested inside the container are then parsed as independent top-level actions.

Root Cause

The root cause is a missing bounds check at nested attribute close time, combined with an inherent truncation when a value larger than U16_MAX is written to the 16-bit nla_len field. This is a numeric truncation error in the container-close path that produces a Time-of-Check to Time-of-Use style divergence between validation and later interpretation of the same action buffer.

Attack Vector

A local user with CAP_NET_ADMIN on an OVS-managed network namespace can craft flow action lists that generate an oversized nested action. The kernel accepts and stores the flow, but on later use it walks a structurally different byte stream. This yields kernel memory disclosure, out-of-bounds parsing, and potential arbitrary action execution inside the datapath. The vulnerability is exploitable locally with low privileges and no user interaction. It affects confidentiality, integrity, and availability of the host kernel.

No public proof-of-concept or in-the-wild exploitation has been reported. See the OpenWall OSS-Security Post for disclosure details.

Detection Methods for CVE-2026-64531

Indicators of Compromise

Kernel warnings, BUG, or KASAN reports originating in net/openvswitch/actions.c or flow_netlink.c
Unexpected ovs-vswitchd flow-installation failures accompanied by kernel oopses
Unprivileged or service accounts loading OVS flow rules that produce action buffers larger than 64 KiB

Detection Strategies

Audit installed kernel versions against the fix commits 1b41cbe, 3f1f755, ab85564, c66bd26, d573250, dbd14f73, and f1efff88 published on git.kernel.org
Monitor auditd and syslog for netlink errors returned from OVS_FLOW_CMD_NEW operations that previously succeeded
Correlate crashes or kernel panics on hosts running OVS with recent flow-table changes made by containers or virtualization control planes

Monitoring Recommendations

Enable kernel lockdown and KASAN in test environments to surface out-of-bounds reads in the OVS action parser
Track processes that hold CAP_NET_ADMIN and issue OVS netlink commands, especially inside untrusted containers
Alert on repeated crashes of ovs-vswitchd or datapath reload events across a fleet

How to Mitigate CVE-2026-64531

Immediate Actions Required

Apply the upstream stable kernel updates that include the referenced fix commits on git.kernel.org
Restrict CAP_NET_ADMIN inside containers and namespaces so untrusted workloads cannot install arbitrary OVS flows
Inventory hosts running OVS datapath in kernel mode and prioritize patching hypervisors, Kubernetes nodes, and OpenStack compute nodes

Patch Information

The fix rejects generated containers that do not fit in nla_len at nested-attribute close time and propagates the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, resource-owning action-list tails are trimmed in reverse construction order before failed wrappers are discarded, ensuring copied resources are released. SET, TUNNEL, and SET_TO_MASKED close-failure paths unwind ownership directly. Fix commits include 1b41cbe, 3f1f755, ab85564, c66bd26, d573250, dbd14f73, and f1efff88.

Workarounds

Where kernel updates cannot be applied immediately, switch datapath to userspace OVS (netdev datapath) on affected hosts if the deployment supports it
Remove CAP_NET_ADMIN from container runtimes and drop the openvswitch module on hosts that do not require it
Constrain flow-installation APIs so that management planes cannot generate action lists that exceed 64 KiB in a single nested container

bash

# Verify running kernel and check for the OVS module
uname -r
lsmod | grep -E 'openvswitch|nf_conntrack'

# Drop CAP_NET_ADMIN for untrusted containers (Docker example)
docker run --cap-drop=NET_ADMIN --cap-drop=SYS_ADMIN <image>

# Unload the module if OVS kernel datapath is not required
sudo modprobe -r openvswitch