« Volver al listado

CVE-2026-74464

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix skb leak on flow key update failure during ct

ovs_ct_execute() always steals or frees the skb on failure while ovs_flow_key_update() does not. So, if it fails and we return right away, the skb ends up leaked.

Fix that by breaking instead and letting the common error handling code at the bottom of the loop to free the skb properly.

This is a very unlikely scenario as it requires the packet to become unparseable by applying a set of actions on a previously parseable skb, but should be fixed nevertheless.

Reported by Sashiko.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-74464",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
              "lessThan": "b77126b2915900f69f9fcf5d624a77c8e6d50c31",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
              "lessThan": "6cc523eaee72c4e91894136cff64946ae9de2cda",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
              "lessThan": "22e0ca88090d89c128078062186b03bb5fdc4f98",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
              "lessThan": "736e972f3f8a304158345223ac6e816166a467ce",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
              "lessThan": "e84dfaac50aab45ad8c670da43e3aa1f97bd2a41",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
              "lessThan": "e0ba8eaef2a0d02a7a485e6a7157e47272b65cea",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
              "lessThan": "393f3c72600ab6721d732a0ab245bc896c5b28fc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
              "lessThan": "bc62e843bc48f933da765ce47079fd992e535794",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/openvswitch/actions.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.3"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.3",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/openvswitch/actions.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T13:17:51.077",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/22e0ca88090d89c128078062186b03bb5fdc4f98",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/393f3c72600ab6721d732a0ab245bc896c5b28fc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6cc523eaee72c4e91894136cff64946ae9de2cda",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/736e972f3f8a304158345223ac6e816166a467ce",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b77126b2915900f69f9fcf5d624a77c8e6d50c31",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bc62e843bc48f933da765ce47079fd992e535794",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e0ba8eaef2a0d02a7a485e6a7157e47272b65cea",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e84dfaac50aab45ad8c670da43e3aa1f97bd2a41",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix skb leak on flow key update failure during ct\n\novs_ct_execute() always steals or frees the skb on failure while\novs_flow_key_update() does not.  So, if it fails and we return right\naway, the skb ends up leaked.\n\nFix that by breaking instead and letting the common error handling\ncode at the bottom of the loop to free the skb properly.\n\nThis is a very unlikely scenario as it requires the packet to become\nunparseable by applying a set of actions on a previously parseable skb,\nbut should be fixed nevertheless.\n\nReported by Sashiko."
    }
  ],
  "lastModified": "2026-08-19T17:21:03.373",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}