CVE-2026-74664

A flaw was found in the Linux kernel's Open vSwitch component. When processing flow updates, the ovs_flow_cmd_new() function preallocates a reply buffer based on the request's flow identifier. If a shorter User Flow ID (UFID) is provided, but the system matches an existing flow with a longer key identifier, the subsequent attempt to write the matched flow's identifier into the preallocated buffer can exceed its size. This can lead to an error and trigger a kernel panic, resulting in a denial of service.

A low impact denial of service flaw was found in the Linux kernel's Open vSwitch implementation as shipped in Red Hat Enterprise Linux 7, 8, 9, and 10 and Red Hat In-Vehicle OS 2. When processing a flow update, ovs_flow_cmd_new() preallocates the reply buffer based on the flow identifier supplied in the request. If a request carries a short unique flow identifier (UFID) and the UFID lookup misses, the flow key lookup can match an existing key-identified flow whose identifier needs more space than was preallocated for the reply. Writing the matched flow's identifier into the reply can then fail with -EMSGSIZE and hit a BUG_ON in the update path, causing a kernel panic and denial of service. Triggering this flaw requires the ability to issue Open vSwitch control-plane flow operations (typically CAP_NET_ADMIN-equivalent privilege); it is not reachable through ordinary network packet forwarding, and the consequence is limited to availability, with no evidence of information disclosure or privilege escalation. For these reasons Red Hat has assessed the impact of this flaw as Low even though the Red Hat CVSS 3.1 base score is 5.5 (Moderate). Fixes for the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams are currently deferred; the residual risk is that a sufficiently privileged local user or process could crash the kernel by issuing a crafted Open vSwitch flow update.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.