AZL-100568 CVE-2026-89487 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

AZL-100205 CVE-2026-89488 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovsmutex. The CT limit pointer was neither removed from readers nor protected by a gra...

CVE-2026-89488

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovsmutex. The CT limit pointer was neither removed from readers nor protected by a gra...

CVE-2026-89487

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

AZL-100814 CVE-2026-80994 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix flow mask use-after-free on flow deletion The commit in the Fixes tag below made so flow-mask free is scheduled via RCU right after it is removed from the flow table. The pointer stays in the flow structure...

CVE-2026-89487

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

CVE-2026-89488

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovsmutex. The CT limit pointer was neither removed from readers nor protected by a gra...

UBUNTU-CVE-2026-89488

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovsmutex. The CT limit pointer was neither removed from readers nor protected by a gra...

CVE-2026-89488 openvswitch: Fix CT limit teardown use-after-free

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovsmutex. The CT limit pointer was neither removed from readers nor protected by a gra...

CVE-2026-89488

CVE-2026-89488 is a slab-use-after-free in the Linux kernel's Open vSwitch (OVS) component, occurring during network namespace teardown . Packet processing reads CT (connection tracking) limit state under RCU, while teardown frees that state under ovs_mutex without removing the pointer from reade...

CVE-2026-89488 openvswitch: Fix CT limit teardown use-after-free

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovsmutex. The CT limit pointer was neither removed from readers nor protected by a gra...

CVE-2026-89488 openvswitch: Fix CT limit teardown use-after-free

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovsmutex. The CT limit pointer was neither removed from readers nor protected by a gra...

CVE-2026-89487

CVE-2026-89487 affects the openvswitch subsystem in the Linux kernel. The bug resides in queue_userspace_packet(), whose error path calls skb_tx_error() on a packet that is still being forwarded through remaining flow actions. This call strips SKBFL_SHARED_FRAG from the live skb via skb_zcopy_cle...

CVE-2026-89487 openvswitch: only skb_tx_error() a packet we are about to drop

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

CVE-2026-89487 openvswitch: only skb_tx_error() a packet we are about to drop

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

EUVD-2026-76393

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

CVE-2026-89487 openvswitch: only skb_tx_error() a packet we are about to drop

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

CVE-2026-89487

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

CVE-2026-80994 net: openvswitch: fix flow mask use-after-free on flow deletion

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix flow mask use-after-free on flow deletion The commit in the Fixes tag below made so flow-mask free is scheduled via RCU right after it is removed from the flow table. The pointer stays in the flow structure...

PT-2026-96376

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovs mutex. The CT limit pointer was neither removed from readers nor protected by a...