CVE-2026-89488

A flaw was found in the Linux kernel's Open vSwitch (OVS) component. An unprivileged user, operating from a user and network namespace, can trigger a use-after-free vulnerability during network namespace teardown. This occurs because packet processing attempts to use connection tracking (CT) limit state after it has been freed, leading to a slab-use-after-free condition. This vulnerability could potentially lead to a denial of service.

This vulnerability is rated as Important severity because an unprivileged local attacker can induce a race condition resulting in a kernel crash (denial of service) or potential arbitrary code execution with kernel privileges, elevating the risk beyond a Moderate flaw. Exploitation requires the ability to instantiate unprivileged namespaces on systems where the openvswitch subsystem is actively processing connection-tracking flows. Standard enterprise deployments that do not load the Open vSwitch module or do not permit unprivileged user namespace creation are not exposed to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the openvswitch kernel module from loading on systems where Open vSwitch is not required:

1. Create a modprobe configuration file to disable the module:

echo "install openvswitch /bin/true" > /etc/modprobe.d/disable-openvswitch.conf

2. If the module is already loaded, unload it:

modprobe -r openvswitch

Warning: Unloading the module or applying this configuration may require restarting services or rebooting the system if the module is currently in use.

Caveat: Disabling the openvswitch module will prevent Open vSwitch from functioning and will break network connectivity in environments that depend on it, such as OpenShift Container Platform clusters utilizing OVN-Kubernetes or OpenShift SDN.