CVE-2025-68785

A slab-out-of-bounds read vulnerability was found in the Linux kernel's Open vSwitch (OVS) module. The push_nsh() action does not validate the middle nested attribute (OVS_KEY_ATTR_NSH) between the outer action and inner key attributes. When the middle attribute has an incorrect size, the nla_data() unwrap causes invalid memory access during action execution, leading to a KASAN-detected out-of-bounds read.

This vulnerability affects systems using Open vSwitch with NSH (Network Service Header) encapsulation. Exploitation requires the ability to configure OVS flow rules, typically requiring root or CAP_NET_ADMIN privileges. The out-of-bounds read occurs during action execution after validation passes due to larger netlink buffer during validation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the openvswitch module from being loaded if Open vSwitch functionality is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.