CVE-2026-98491

A flaw was found in the Linux kernel's Open vSwitch subsystem. When cloned network packet buffers share an unconfirmed connection tracking entry, committing the entry with conflicting extensions can trigger a use-after-free memory issue during cleanup. An attacker could exploit this vulnerability to cause memory corruption, leading to a system crash and Denial of Service (DoS), or potentially execute arbitrary code.

A race in Open vSwitch conntrack handling can occur when cloned skbs share the same unconfirmed conntrack entry and both clones attempt to commit it with different extension sets. One commit can wire a helper extension into an expectation list while another commit changes the shared extension storage, leaving a stale pointer that can be dereferenced during the later destruction path and cause a use after free. The confirmed impact is at least a kernel crash and denial of service. Because this is a real stale pointer memory safety condition, confidentiality and integrity impact or privilege escalation may also be possible, although no reliable write primitive or working escalation path is established. For the CVSS the PR:N value is used in the paranoid assessment because an attacker may only need packet access after a vulnerable Open vSwitch pipeline has already been configured by an administrator. The attack is considered adjacent network rather than unrestricted remote network because it depends on access to the affected virtual switch or connected network segment. Attack complexity is high because two cloned packets must reach conflicting commit paths in the required order and race window.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.