CVE-2026-80994

A flaw was found in the Open vSwitch component of the Linux kernel. A local attacker could exploit a use-after-free vulnerability during flow deletion. This occurs due to a race condition where the flow mask is freed prematurely, allowing subsequent operations to access deallocated memory. Successful exploitation of this flaw can lead to a system crash, resulting in a Denial of Service (DoS).

An Open vSwitch flow deletion race can cause a use after free because ovs_flow_tbl_remove may schedule flow mask release through RCU before ovs_flow_cmd_fill_info finishes building the delete reply. The stale flow mask pointer can still be read in the same operation, and KASAN reports a slab use after free in __ovs_nla_put_key while formatting the netlink response. For the CVSS the PR:L is used for the paranoid score because reliable triggering may be possible by a local actor with delegated OVS flow control, CAP_NET_ADMIN in a container like environment, or control of a local Open vSwitch management service rather than full host root. The issue is not directly reachable by raw network packets, but it may be reachable through an OVS control plane that can request flow deletion. Impact is at least local denial of service via kernel crash and may include confidentiality impact because freed mask memory is read while constructing a netlink message. Integrity impact is limited because the patch does not show an arbitrary write primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.