CVE-2026-45840

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: cap upcall PID array size and pre-size vport replies

The vport netlink reply helpers allocate a fixed-size skb with

nlmsg_new(NLMSG_DEFAULT_SIZE, ...) but serialize the full upcall PID

array via ovs_vport_get_upcall_portids(). Since

ovs_vport_set_upcall_portids() accepts any non-zero multiple of

sizeof(u32) with no upper bound, a CAP_NET_ADMIN user can install a PID

array large enough to overflow the reply buffer, causing nla_put() to

fail with -EMSGSIZE and hitting BUG_ON(err < 0). On systems with

unprivileged user namespaces enabled (e.g., Ubuntu default), this is

reachable via unshare -Urn since OVS vport mutation operations use

GENL_UNS_ADMIN_PERM.

kernel BUG at net/openvswitch/datapath.c:2414!

Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI

CPU: 1 UID: 0 PID: 65 Comm: poc Not tainted 7.0.0-rc7-00195-geb216e422044 #1

RIP: 0010:ovs_vport_cmd_set+0x34c/0x400

Call Trace:

<TASK>

genl_family_r

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References