CVE-2026-74664: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-74664 Overview

CVE-2026-74664 is a Linux kernel vulnerability in the Open vSwitch (OVS) netlink flow update path. The ovs_flow_cmd_new() function preallocates the optional reply socket buffer (skb) before acquiring ovs_mutex and before resolving which existing flow will be updated. When a request carrying a short Unique Flow Identifier (UFID) misses the UFID lookup and falls back to a flow key lookup, the matched flow's identifier may exceed the preallocated reply size. The subsequent ovs_flow_cmd_fill_info() call can then fail with -EMSGSIZE and trigger a BUG_ON(error < 0) in the update path, causing a kernel panic.

Critical Impact
A local user with permission to issue Open vSwitch netlink commands can trigger a kernel BUG_ON() assertion, resulting in a denial-of-service condition on the host.

Affected Products

Linux kernel builds with CONFIG_OPENVSWITCH enabled prior to the fix
Distributions shipping affected stable kernel branches referenced in the upstream patches
Virtualization and container hosts using Open vSwitch datapaths

Discovery Timeline

2026-08-22 - CVE-2026-74664 published to NVD
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74664

Vulnerability Analysis

The defect lives in net/openvswitch/datapath.c inside the ovs_flow_cmd_new() handler. The function sizes and allocates the optional echoed reply skb using the request's flow identifier before it takes ovs_mutex. At allocation time the kernel assumes the request identifier will also become the identifier written into the reply.

For new flows that assumption holds. For update operations it does not. UFIDs are optional, and the flow key remains the primary identifier. A request that carries a UFID may miss the UFID lookup and legitimately match an existing key-identified flow via the flow key path. When ovs_flow_cmd_fill_info() later serializes the matched flow, it writes the matched flow's identifier rather than the shorter request UFID that was used to size the buffer.

If the matched identifier is larger than the preallocated space, the netlink fill fails with -EMSGSIZE. The update path treats fill failures as unreachable and calls BUG_ON(error < 0), which panics the kernel or oopses the task depending on configuration. This is a denial-of-service condition classified as a Kernel Vulnerability with a resource sizing race between allocation and target resolution.

Root Cause

The root cause is a mismatch between the identifier used to size the reply skb and the identifier that ultimately gets written into it. Preallocation occurs before the update target is known, so the buffer can be too small for the resolved flow's key identifier.

Attack Vector

Exploitation requires local netlink access to the Open vSwitch generic netlink family, which typically requires CAP_NET_ADMIN. An attacker crafts an OVS_FLOW_CMD_NEW request that includes a short UFID and the NLM_F_ECHO flag, targeting an existing flow that was inserted with a longer key identifier. When the UFID lookup misses and the key lookup succeeds, the fill routine overruns the preallocated echo skb and hits the BUG_ON().

No verified public exploit code is available. The upstream fix reallocates the reply skb after the update target is resolved, before actions are replaced, so a failed reallocation returns cleanly instead of panicking. Refer to the upstream fix commit for the exact source-level change.

Detection Methods for CVE-2026-74664

Indicators of Compromise

Kernel oops or panic messages referencing ovs_flow_cmd_new or ovs_flow_cmd_fill_info in dmesg or /var/log/kern.log.
Unexpected BUG_ON traces originating in net/openvswitch/datapath.c on hosts running Open vSwitch.
Host or virtualization node reboots correlated with OVS control-plane activity such as ovs-vsctl or ovs-ofctl operations.

Detection Strategies

Audit kernel version and CONFIG_OPENVSWITCH status across fleet inventory and cross-reference against the stable branches patched by the referenced commits.
Enable kernel.panic_on_oops=1 and centralized kernel log collection to capture the fault site when the BUG_ON fires.
Monitor AUDIT_NETFILTER_CFG and generic netlink usage from non-administrative processes to surface unexpected OVS control operations.

Monitoring Recommendations

Forward dmesg and journald kernel facility logs to a centralized data lake and alert on stack frames containing openvswitch symbols.
Track processes invoking OVS user-space tools and correlate them with kernel warnings on the same host within a short window.
Baseline flow-add rates per host and alert on anomalous bursts targeting the same datapath.

How to Mitigate CVE-2026-74664

Immediate Actions Required

Update to a Linux stable kernel release that includes one of the fix commits listed in the references, such as 00f987f0 or the matching backport for your branch.
Restrict CAP_NET_ADMIN and access to the Open vSwitch generic netlink family to trusted administrators and orchestration components only.
Enable centralized kernel crash reporting so that any panic reaching the BUG_ON path is captured and triaged.

Patch Information

The fix reallocates the reply skb inside ovs_flow_cmd_new() after the update target has been resolved and before actions are replaced. This lets the request fail cleanly with -ENOMEM on rare allocation failure instead of panicking. Backports are available across multiple stable branches: 20751193, 23716dd9, 5d1c224d, 696a0b94, 69f40ccf, 87d0c004, and bd8ca84d.

Workarounds

If patching cannot be scheduled immediately, unload the openvswitch kernel module on hosts that do not require it and switch to an alternate datapath such as the Linux bridge or a user-space OVS-DPDK build.
Constrain OVS management to a dedicated administrative user and remove CAP_NET_ADMIN from workloads that do not need direct datapath control.
Deploy sandboxing (seccomp, namespaces) around any tooling that programmatically issues OVS flow updates to reduce the local attack surface.