CVE-2026-98490

A flaw was found in the Linux kernel's Open vSwitch subsystem. When connection tracking helpers process unconfirmed connections, subsequent memory reallocations for extensions can leave a dangling pointer in the connection expectations list. An attacker can exploit this issue by sending specially crafted network packets to trigger a use-after-free condition, leading to a Denial of Service (DoS) through a kernel crash or potentially arbitrary code execution.

This vulnerability is rated as an Important severity issue because an unauthenticated remote attacker can trigger a kernel crash by transmitting malformed traffic through networks managed by Open vSwitch. The flaw requires the host to actively process traffic using Open vSwitch connection tracking with protocol helpers enabled, which is not configured by default on standard Red Hat Enterprise Linux deployments. While upstream assigns a Critical rating due to theoretical arbitrary code execution, Red Hat rates the impact as Important because practical exploitation leads to a denial of service via a kernel panic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to defer conntrack helper invocation in Open vSwitch until after all connection tracking extensions have been committed and allocated: upgrade to the fixed Kernel/Kernel Rt/Kernel Ivos Qualcomm/Openshift/Ose Rhel Coreos/Kpatch builds, which defer conntrack helper invocation until the end of ovs_ct_commit after all other extensions have been allocated, closing specially crafted network packets targeting conntrack helper flows. Until patched, this is only a concern on Linux systems running Open vSwitch with conntrack helpers and extensions enabled — Non-Linux operating systems are unaffected — so Restrict network traffic to Open vSwitch conntrack helper flows, or avoid combining helper processing with additional extension assignments on unconfirmed connections. As a compensating measure, enable runtime memory error detection such as KASAN or HWASan to detect use-after-free access and dangling pointer dereferences and enable SLAB freelist hardening including freelist randomization and integrity checks to impede exploitation of reallocated extension memory. These controls limit blast radius and contain exploitation, but they do not fix the underlying conntrack helper use-after-free defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1005 Runtime Memory Error Detection (KASAN/HWASan) (medium)