CVE-2026-80994 Overview
CVE-2026-80994 is a use-after-free vulnerability in the Linux kernel's Open vSwitch (OVS) subsystem. The flaw resides in the flow deletion path within net/openvswitch/datapath.c and net/openvswitch/flow_netlink.c. When processing a CMD_DEL netlink command, ovs_flow_tbl_remove() schedules the flow->mask for RCU-based release before ovs_flow_cmd_fill_info() reads it. Because no RCU read lock is held prior to removal, the grace period can elapse mid-operation, freeing the mask while the netlink reply builder still references it. Trend Micro's Zero Day Initiative reported the issue as ZDI-CAN-32042.
Critical Impact
A local user with the ability to issue Open vSwitch netlink commands can trigger a kernel use-after-free, leading to memory corruption, denial of service, or potential local privilege escalation.
Affected Products
- Linux kernel branches containing the Open vSwitch flow-mask RCU rework identified by the Fixes reference
- Stable kernel trees patched by commits 0ba5cbc, 18ce1a8, 4e30317, 64051fe, 7f072b8, ac73e3a, c15ef9a, and ea5f7b4
- Distributions shipping unpatched OVS-enabled kernels
Discovery Timeline
- Vulnerability reported by Trend Micro's Zero Day Initiative as ZDI-CAN-32042
- 2026-09-11 - CVE-2026-80994 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-80994
Vulnerability Analysis
The defect is a slab use-after-free in the Open vSwitch flow deletion handler. A prior refactor scheduled flow->mask for release through RCU immediately after removal from the flow table, avoiding the need for ovs_mutex in ovs_flow_free(). The pointer remained embedded in the flow structure and was intended to stay valid for the duration of the enclosing RCU critical section.
During ovs_flow_cmd_del(), the kernel calls ovs_flow_tbl_remove() before ovs_flow_cmd_fill_info(). No RCU read lock is taken prior to removal. The subsequent rcu_read_lock() inside the fill path is cosmetic. If the RCU grace period completes between removal and the netlink reply construction, __ovs_nla_put_key() and ovs_nla_put_key() dereference freed memory. KASAN traces confirm the read of freed slab memory at net/openvswitch/flow_netlink.c:1996 and :2250.
Root Cause
The root cause is an ordering error combined with a missing RCU read-side critical section. The GFP_KERNEL allocation performed while building the netlink info can sleep, widening the race window and making a wider RCU critical section infeasible without additional refactoring. The fix reorders operations so ovs_flow_tbl_remove() runs after ovs_flow_cmd_fill_info() completes, and removes the cosmetic RCU read lock and the forced pointer cast.
Attack Vector
Exploitation requires local access and the ability to send OVS generic netlink messages, typically gated by CAP_NET_ADMIN. An attacker races concurrent flow-deletion and flow-dump activity to trigger the freed-mask dereference during netlink reply construction. Successful races corrupt kernel slab memory, enabling denial of service and, depending on heap layout, escalation primitives.
No public exploit code is available. Refer to the upstream commits for the fix diffs and reproducer context.
Detection Methods for CVE-2026-80994
Indicators of Compromise
- KASAN reports containing slab-use-after-free in __ovs_nla_put_key or ovs_nla_put_key in kernel logs
- Unexpected kernel oops or panic traces originating from ovs_flow_cmd_del and ovs_flow_cmd_fill_info
- Repeated crashes of user-space OVS control processes correlated with high-frequency flow add/delete cycles
Detection Strategies
- Monitor dmesg and journald for KASAN slab-use-after-free signatures referencing net/openvswitch/flow_netlink.c
- Audit processes issuing OVS_FLOW_CMD_DEL generic netlink messages, correlating with users holding CAP_NET_ADMIN
- Track kernel version and Open vSwitch module build IDs across fleet inventory to identify unpatched hosts
Monitoring Recommendations
- Enable kernel crash reporting (kdump, systemd-coredump) and forward traces to a central log store for triage
- Alert on abnormal volumes of netlink traffic targeting the OVS family from non-orchestrator processes
- Baseline flow churn on OVS bridges and flag sustained anomalous add/delete bursts that may indicate race exploitation
How to Mitigate CVE-2026-80994
Immediate Actions Required
- Apply the upstream stable kernel updates that include commits 0ba5cbc, 18ce1a8, 4e30317, 64051fe, 7f072b8, ac73e3a, c15ef9a, and ea5f7b4
- Restrict CAP_NET_ADMIN and access to the OVS netlink family to trusted service accounts only
- Inventory hosts running Open vSwitch and prioritize patching on multi-tenant nodes such as hypervisors and Kubernetes workers
Patch Information
The fix reorders ovs_flow_tbl_remove() to run after ovs_flow_cmd_fill_info() completes, ensuring flow->mask remains valid for the duration of the netlink reply. The change also removes the cosmetic RCU read lock and the forced pointer cast. Distribution vendors are backporting the fix through their stable kernel channels. See the upstream commits: 0ba5cbc, 18ce1a8, 4e30317, 64051fe, 7f072b8, ac73e3a, c15ef9a, and ea5f7b4.
Workarounds
- Unload the openvswitch kernel module on hosts that do not require OVS datapath functionality
- Constrain container and VM workloads with seccomp and user namespaces to block unprivileged netlink access to the OVS family
- Where patching is delayed, reduce flow-deletion churn by tuning orchestrator flow lifetimes to shrink the race window
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.