CVE-2026-89487

A flaw was found in openvswitch in the Linux kernel. This vulnerability occurs when the queueuserspacepacket function incorrectly modifies a shared network packet buffer by stripping a critical flag. This action can lead to an unprivileged page-cache write, allowing a local attacker to modify dat...

CVE-2026-89487

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

CVE-2026-89488

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovsmutex. The CT limit pointer was neither removed from readers nor protected by a gra...

CVE-2026-89488

CVE-2026-89488 is a slab-use-after-free in the Linux kernel's Open vSwitch (OVS) connection-tracking (CT) limit handling. Packet processing reads CT limit state under RCU , while network-namespace teardown frees it under ovs_mutex without a grace period, leaving a dangling pointer that packet pro...

CVE-2026-89488 openvswitch: Fix CT limit teardown use-after-free

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovsmutex. The CT limit pointer was neither removed from readers nor protected by a gra...

EUVD-2026-76393

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

CVE-2026-89487 openvswitch: only skb_tx_error() a packet we are about to drop

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

CVE-2026-89487

In the Linux kernel's Open vSwitch subsystem, queue_userspace_packet() erroneously calls skb_tx_error() on a borrowed skb that do_execute_actions() continues to forward, stripping the SKBFL_SHARED_FRAG flag. For a MSG_ZEROCOPY skb carrying page-cache fragments, this causes a later ESP-in-UDP deli...

CVE-2022-2639-PipeVersion

CVE-2022-2639 using pipe primitive CVE-2022-2639: Linux kernel openvswitch local privilege escalation. introduced in: e64457191a259537bbbfaebeba9a8043786af96f v3.13 fixed in: cefa91b2332d7009bc0be5d951d6cbbf349f90f8 v5.18 Using pipe-primitive to exploit CVE-2022-2639, so no kaslr leak nor smap sm...

PT-2026-90204

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovs mutex. The CT limit pointer was neither removed from readers nor protected by a...

PT-2026-90203

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skb tx error a packet we are about to drop queue userspace packet borrows the packet skb -- it only copies it into a private netlink message user skb and does not own it; on return do execute actions keeps...

PT-2026-90124

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix flow mask use-after-free on flow deletion The commit in the Fixes tag below made so flow-mask free is scheduled via RCU right after it is removed from the flow table. The pointer stays in the flow structure...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098998)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098998 advisory. In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix middle attribute validation in pushnsh action The pushnsh action structure...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098850)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098850 advisory. In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix unsafe attribute parsing in outputuserspace This patch replaces the manual Netli...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.11 bug fix and security update

Red Hat OpenShift Container Platform release 4.22.11 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...

RHEL 9 : kpatch-patch-5_14_0-687_10_1 (RHSA-2026:59149)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:59149 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

RHEL 10 : kpatch-patch-6_12_0-211_16_1 (RHSA-2026:59143)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:59143 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This pat...

Important: Red Hat Security Advisory: kpatch-patch-5_14_0-687_10_1 security update

An update for kpatch-patch-5140-687101 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: Red Hat Security Advisory: kpatch-patch-5_14_0-427_100_1, kpatch-patch-5_14_0-427_113_1, kpatch-patch-5_14_0-427_126_1, kpatch-patch-5_14_0-427_68_2, and kpatch-patch-5_14_0-427_84_1 security update

An update for multiple packages is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Important: Red Hat Security Advisory: kpatch-patch-5_14_0-284_117_1, kpatch-patch-5_14_0-284_134_1, kpatch-patch-5_14_0-284_148_1, kpatch-patch-5_14_0-284_158_1, and kpatch-patch-5_14_0-284_172_1 security update

An update for multiple packages is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...