CVE-2026-80994

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix flow mask use-after-free on flow deletion

The commit in the Fixes tag below made so flow->mask free is scheduled

via RCU right after it is removed from the flow table. The pointer

stays in the flow structure and it can be accessible while in the same

RCU critical section. This is done to avoid requiring ovs_mutex for

the ovs_flow_free().

However, while removing the flow during processing of CMD_DEL, we do

not take RCU read lock before the removal, and ovs_flow_cmd_fill_info()

uses the flow->mask pointer afterwards. The RCU read lock is taken,

but it's already late at that point. The comment on that line

acknowledges that the lock is cosmetic and doesn't serve a real purpose.

This leads to use-after-free if the RCU grace period passes between

removal and the filling. It is a short race window, but it is there

and can lead to a real crash in case memory allocation for the info

takes a bit l

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References