CVE-2026-97611

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix use-after-free of the flow table mask array

tbl_mask_array_realloc() retires the old mask_array before it stops being

reachable:

old = ovsl_dereference(tbl->mask_array);

if (old) {

...

call_rcu(&old->rcu, mask_array_rcu_cb);

}

rcu_assign_pointer(tbl->mask_array, new);

call_rcu() only waits for read-side critical sections already in flight.

tbl->mask_array still points at old between the call_rcu() and the

rcu_assign_pointer(), so a reader entering ovs_flow_tbl_lookup_stats() in

that window picks up old in a fresh critical section that the pending

grace period does not cover.

tbl_mask_array_realloc() runs in process context under ovs_mutex, so the

window is preemptible and can outlast the grace period. Then

mask_array_rcu_cb() frees old before the swap runs:

BUG: KASAN: slab-use-after-free in flow_lookup.constprop.0+0x2bf/0x2f0

Read of size 8 at addr ffff888020b3e018 by task poc/

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References