---
id: CVE-2026-97611
title: "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix use-after-free of the flow table mask array\n\ntbl_mask_array_realloc() retires the old mask_array before it stops being\nreachable:\n\n\told = ovsl_der…"
summary: "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix use-after-free of the flow table mask array\n\ntbl_mask_array_realloc() retires the old mask_array before it stops being\nreachable:\n\n\told = ovsl_der…"
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= eac87c413bf9794c14d488998a5265ea5b32f04e <
    cd982e11684def5d4a9fcfd5354de09032828414
  - >-
    Linux >= eac87c413bf9794c14d488998a5265ea5b32f04e <
    a0d18d21d48a551f82ee344e50efb8a682161489
  - >-
    Linux >= eac87c413bf9794c14d488998a5265ea5b32f04e <
    035e9c3722067648a99010711d0ce81f42572ef4
  - >-
    Linux >= eac87c413bf9794c14d488998a5265ea5b32f04e <
    ba4ba11ed6eb8972c69070417fc27b48deb002e8
  - Linux 5.9
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T15:18:01.373'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97611'
references:
  - url: 'https://git.kernel.org/stable/c/035e9c3722067648a99010711d0ce81f42572ef4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a0d18d21d48a551f82ee344e50efb8a682161489'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ba4ba11ed6eb8972c69070417fc27b48deb002e8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cd982e11684def5d4a9fcfd5354de09032828414'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.899Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix use-after-free of the flow table mask array

tbl_mask_array_realloc() retires the old mask_array before it stops being
reachable:

	old = ovsl_dereference(tbl->mask_array);
	if (old) {
		...
		call_rcu(&old->rcu, mask_array_rcu_cb);
	}

	rcu_assign_pointer(tbl->mask_array, new);

call_rcu() only waits for read-side critical sections already in flight.
tbl->mask_array still points at old between the call_rcu() and the
rcu_assign_pointer(), so a reader entering ovs_flow_tbl_lookup_stats() in
that window picks up old in a fresh critical section that the pending
grace period does not cover.

tbl_mask_array_realloc() runs in process context under ovs_mutex, so the
window is preemptible and can outlast the grace period. Then
mask_array_rcu_cb() frees old before the swap runs:

  BUG: KASAN: slab-use-after-free in flow_lookup.constprop.0+0x2bf/0x2f0
  Read of size 8 at addr ffff888020b3e018 by task poc/741
   flow_lookup.constprop.0+0x2bf/0x2f0
   ovs_flow_tbl_lookup_stats+0x4a3/0x5c0
   ovs_dp_process_packet+0x19c/0x710
   ovs_vport_receive+0x243/0x390
   internal_dev_xmit+0x81/0x170
  Freed by task 728:
   kfree+0x16a/0x4e0
   rcu_core+0x853/0x1030

Publish the new array before retiring the old one. The kfree_rcu() that
call_rcu() replaced ran after the swap.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.