CVE-2026-98251

A flaw was found in the Linux kernel's Open vSwitch component. When handling network connection tracking (conntrack) labels, the kernel may reallocate memory for active connections while another processor accesses it simultaneously. This race condition can lead to memory corruption, allowing an attacker to cause a system crash and a Denial of Service (DoS).

A race in Open vSwitch conntrack label handling can occur when ovs_ct_get_conn_labels adds a labels extension to an already confirmed conntrack. Confirmed conntracks may be read locklessly, while adding the extension can reallocate and free the old extension block as another CPU is still accessing it. This creates a potential use after free condition that can cause a kernel crash and may permit broader memory corruption impact if the freed storage is reused in a controllable way. For the CVSS the PR:N is selected because a remote attacker does not need a local account when existing Open vSwitch rules apply conntrack label operations to attacker controlled traffic. Triggering still requires a suitable Open vSwitch configuration and winning a concurrency window, so AC:H is appropriate. The base assessment uses AV:A because Open vSwitch datapaths are commonly exposed to local, virtual, or data center network segments. The paranoid assessment uses AV:N where traffic from a remote network can reach the affected datapath. Impact is at least denial of service via kernel crash and in the worst defensible case may include confidentiality, integrity, and privilege escalation impact due to the potential use after free.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.