SECUFOCUSNOW
Home›CVE index›CVE-2026-64531
Review reviewHigh

CVE-2026-64531

Linux

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structural...

CVSS
7.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.27
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structural...

Affected product and versions

Product
Linux
Affected versions
>= 057dbc5b72e9fcac439cd561c3a539b8a0edeb92 < ab855641241387db062a5e41d9ad6b8561542572, >= 2532adbfe917c0e71dba2650ffc6efe396314c87 < c66bd2626c2764f23764ff0f8277f44a9cfe8349, >= 4b1a0ee6164c7204c68ab5a9c48c07bfe8852485 < d573250d228401f707f4dbc09d11227a6215ee5f, >= e6610f9c08b4c04cf7949c10fc246c071d00e935 < f1efff8858403191361a01269c6fe8dd7f55a385, >= a1e64addf3ff9257b45b78bc7d743781c3f41340 < dbd14f736be02cfe73049bd801af89becd1a0749, >= a1e64addf3ff9257b45b78bc7d743781c3f41340 < 1b41cbe05b184f8861712f0806cc0c4f5d8c6dfe, >= a1e64addf3ff9257b45b78bc7d743781c3f41340 < 3f1f755366687d051174739fb99f7d560202f60b, >= 6b099d285d7ed324494b6d684f377aa103856118, >= 5.15.180 < 5.15.212, >= 6.1.132 < 6.1.178, >= 6.6.84 < 6.6.145, >= 6.12.20 < 6.12.97, >= 6.13.8 < 6.14, >= 6.14
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Not available