CVE-2026-89488

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: Fix CT limit teardown use-after-free

Packet processing uses CT limit state under RCU, while netns teardown

frees that state under ovs_mutex. The CT limit pointer was neither removed

from readers nor protected by a grace period, allowing packet processing to

dereference the freed state.

An unprivileged user can trigger this bug from a user and network

namespace, causing a slab-use-after-free in ovs_ct_execute() when the

netns is torn down.

Publish the CT limit pointer through RCU, remove it before teardown, and

wait for readers before freeing its contents. Keep ovs_mutex around

individual CT limit updates, and use the RCU read-side lock while GET

traverses the RCU-protected limit lists.

Netns teardown detaches the RCU-protected CT limit state in the pernet

.pre_exit callback while holding ovs_mutex. The pernet core guarantees an

RCU grace period between the .pre_exit and .exit callbacks, so the .exit

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References