CVE-2026-74465

A flaw was found in the Linux kernel's Open vSwitch (OVS) component. When a new meter is attached, the attach_meter() function makes it visible to other central processing units (CPUs) before all checks are complete. If the attachment fails, the meter is freed without waiting for other CPUs to stop using it, leading to a Use-After-Free (UAF) vulnerability. A local attacker with the ability to use the user-space API (uAPI) could exploit this to cause memory corruption, potentially leading to a denial of service or arbitrary code execution.

A use-after-free vulnerability was found in the Linux kernel's Open vSwitch (OVS) module, which Red Hat Product Security has rated as having a MODERATE impact. When a new meter is attached, the attach_meter() function makes the meter visible to other CPUs before all checks have completed; if the attachment subsequently fails, ovs_meter_cmd_set() frees the meter with a plain kfree() without waiting for RCU readers to finish, so a concurrent packet-execution path can still dereference the freed meter in ovs_meter_execute(). A local attacker with the ability to use the Open vSwitch netlink uAPI, for example through a custom application, could race meter creation with concurrent packet execution to trigger this use-after-free, causing memory corruption that can result in a kernel crash and denial of service, with potential for arbitrary code execution. The standard ovs-vswitchd daemon is not exposed to this issue because it always creates meters before creating any flows that use them. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those kernels; the affected Red Hat Enterprise Linux 8, 9, and 10 kernel and kernel-rt streams, as well as the Red Hat In-Vehicle OS kernels, contain the vulnerable code and their fixes are currently deferred. The residual risk while the fix is deferred is limited: exploitation requires local access and the ability to control OVS meter configuration through the uAPI, and it depends on winning a race between a meter attachment failure and concurrent packet processing. Red Hat rates this issue MODERATE (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while the upstream CVE record assigns 7.8; the difference reflects Red Hat's assessment that the most realistic impact is local denial of service and that exploitation requires local uAPI access via a custom application rather than remote network access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.