CVE-2026-64531

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: reject oversized nested action attrs

Open vSwitch stores generated flow actions as nlattrs, whose nla_len

field is u16. Commit a1e64addf3ff ("net: openvswitch: remove

misbehaving actions length check") allowed the total sw_flow_actions

stream to grow beyond 64 KiB, which is valid, but also removed the last

guard preventing a generated nested action attribute from exceeding

U16_MAX.

An oversized generated container can thus be closed with a truncated

nla_len. A later dump or teardown then walks a structurally different

stream than the one that was validated. In particular, an oversized

nested CLONE/CT action may cause subsequent bytes in the generated

stream to be interpreted as independent actions.

Keep the larger total-action-stream behavior, but make nested action

close reject generated containers that do not fit in nla_len, and return

the error through all callers. For recursive SAMPLE, CLONE,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References