Medium · published June 25, 2026
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: fix possible kfree_skb of ERR_PTR
After the patch in the "Fixes" tag, the allocation of the "reply" skb
can happen either before or after locking the ovs_mutex.
However, error cleanups still follow the classical reversed order,
assuming "reply" is allocated before locking: it is freed after unlocking.
If "reply" allocation happens after locking the mutex and it fails,
"reply" is left with an ERR_PTR, and execution jumps to the correspondent
cleanup stage which will try to free an invalid pointer.
Fix this by setting the pointer to NULL after having saved its error
value.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 3.16, < 5.10.259 | 5.10.259 |
| linux/linux_kernel | ≥ 5.11, < 5.15.210 | 5.15.210 |
| linux/linux_kernel | ≥ 5.16, < 6.1.176 | 6.1.176 |
| linux/linux_kernel | ≥ 6.2, < 6.6.143 | 6.6.143 |
| linux/linux_kernel | ≥ 6.7, < 6.12.94 | 6.12.94 |
| linux/linux_kernel | ≥ 6.13, < 6.18.36 | 6.18.36 |
| linux/linux_kernel | ≥ 6.19, < 7.0.13 | 7.0.13 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |