Description

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix use-after-free of the flow table mask array tbl_mask_array_realloc() retires the old mask_array before it stops being reachable: old = ovsl_dereference(tbl->mask_array); if (old) { ... call_rcu(&old->rcu, mask_array_rcu_cb); } rcu_assign_pointer(tbl->mask_array, new); call_rcu() only waits for read-side critical sections already in flight. tbl->mask_array still points at old between the call_rcu() and the rcu_assign_pointer(), so a reader entering ovs_flow_tbl_lookup_stats() in that window picks up old in a fresh critical section that the pending grace period does not cover. tbl_mask_array_realloc() runs in process context under ovs_mutex, so the window is preemptible and can outlast the grace period. Then mask_array_rcu_cb() frees old before the swap runs: BUG: KASAN: slab-use-after-free in flow_lookup.constprop.0+0x2bf/0x2f0 Read of size 8 at addr ffff888020b3e018 by task poc/741 flow_lookup.constprop.0+0x2bf/0x2f0 ovs_flow_tbl_lookup_stats+0x4a3/0x5c0 ovs_dp_process_packet+0x19c/0x710 ovs_vport_receive+0x243/0x390 internal_dev_xmit+0x81/0x170 Freed by task 728: kfree+0x16a/0x4e0 rcu_core+0x853/0x1030 Publish the new array before retiring the old one. The kfree_rcu() that call_rcu() replaced ran after the swap.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-25T11:17:15.213Z",
  "pubdate": "2026-09-25T11:17:15.213Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Open vSwitch (OVS) module of the Linux kernel, specifically within the mask array management logic of the flow table.\nThe vulnerability arises due to an incorrect ordering of operations when reallocating the flow table mask array, leading to a race condition where memory is freed while still in use by concurrent read operations.\nSuccessful exploitation allows an attacker to trigger a kernel use-after-free, which can lead to system instability, kernel panics, or potentially arbitrary code execution by leveraging the dangling pointer.\nThe issue affects the Linux kernel's net/openvswitch subsystem. It requires an attacker to trigger flow table updates while concurrent lookups are occurring, necessitating local access or the ability to influence flow table configurations.\nThe flaw stems from a violation of RCU (Read-Copy-Update) semantics where the pointer to the old mask array is retired via call_rcu() before the new array is assigned to the table, creating a critical window for memory corruption.",
  "technicalDetails": "The vulnerability is located in the tbl_mask_array_realloc() function within the Linux kernel's openvswitch implementation. The primary issue is a race condition resulting from the premature retirement of the old mask_array structure.\nIn the vulnerable code path, the kernel retrieves the existing mask_array and invokes call_rcu() to schedule its destruction via mask_array_rcu_cb(). However, the pointer tbl->mask_array is not updated to point to the new, valid array until after the call_rcu() invocation.\nBecause tbl_mask_array_realloc() executes in process context under the ovs_mutex, the execution thread is preemptible. If the thread is preempted between the call_rcu() call and the rcu_assign_pointer() update, the grace period for the old memory may expire and trigger the RCU callback.\nConcurrent read-side critical sections, such as those initiated by ovs_flow_tbl_lookup_stats(), access the old mask_array via the still-unupdated tbl->mask_array pointer. Once mask_array_rcu_cb() executes kfree() on the old structure, any subsequent read operation that dereferences this pointer results in a use-after-free condition.\nThe attack flow follows a deterministic pattern: 1) The system enters a state where a mask array reallocation is triggered. 2) The kernel schedules the old array for deletion while it remains active in the lookup table. 3) An attacker or system activity induces a race condition, causing the scheduler to preempt the realloc process. 4) The RCU mechanism identifies the grace period as elapsed, and the memory is reclaimed. 5) A subsequent flow lookup operation attempts to access the now-freed memory address (slab-use-after-free), leading to a kernel crash or potential exploit primitive.\nThis vulnerability highlights a critical failure in RCU synchronization primitives, specifically regarding the sequence of publication and retirement. By failing to ensure that the new pointer is published to the global view before the old pointer is marked for reclamation, the kernel violates the safety requirements of the RCU subsystem, rendering the flow table lookup mechanism vulnerable to exploitation.\nThe exploitation surface is restricted to environments where the attacker can trigger OVS flow table updates and force concurrent lookups. This typically requires local user privileges to interact with the netlink interface for OVS, making it a local privilege escalation or denial-of-service vector."
}