CVE-2025-40254

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: remove never-working support for setting nsh fields

The validation of the set(nsh(...)) action is completely wrong.

It runs through the nsh_key_put_from_nlattr() function that is the

same function that validates NSH keys for the flow match and the

push_nsh() action. However, the set(nsh(...)) has a very different

memory layout. Nested attributes in there are doubled in size in

case of the masked set(). That makes proper validation impossible.

There is also confusion in the code between the 'masked' flag, that

says that the nested attributes are doubled in size containing both

the value and the mask, and the 'is_mask' that says that the value

we're parsing is the mask. This is causing kernel crash on trying to

write into mask part of the match with SW_FLOW_KEY_PUT() during

validation, while validate_nsh() doesn't allocate any memory for it:

BUG: kernel NULL pointer dereference, address: 00000

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References