Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-74464

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in ovs_flow_key_update() handling within net/openvswitch/actions.c when processing connection tracking actions on a packet whose flow key becomes invalid and unparseable. A local user can trigger flow key update failure with a specially crafted packet and action sequence to cause a denial of service.

This requires the packet to become unparseable after actions are applied to a previously parseable skb.

Affected software

How to mitigate CVE-2026-74464

External References

• https://git.kernel.org/stable/c/393f3c72600ab6721d732a0ab245bc896c5b28fc
• https://git.kernel.org/stable/c/736e972f3f8a304158345223ac6e816166a467ce
• https://git.kernel.org/stable/c/bc62e843bc48f933da765ce47079fd992e535794
• https://git.kernel.org/stable/c/e0ba8eaef2a0d02a7a485e6a7157e47272b65cea
• https://git.kernel.org/stable/c/e84dfaac50aab45ad8c670da43e3aa1f97bd2a41

Related Security Bulletins

• Missing Release of Resource after Effective Lifetime in Linux kernel openvswitch
• Debian update for linux