ZDI-26-687: Linux Kernel Open vSwitch Flow Delete Use-After-Free Information Disclosure Vulnerability

The Linux kernel's Open vSwitch module (net/openvswitch) contains a use-after-free in which a flow's mask is scheduled to be freed via RCU as soon as the flow is removed from the flow table, yet ovs_flow_cmd_fill_info() dereferences the stale flow->mask pointer afterwards — the RCU read lock is taken too late to protect it. A local attacker with the privileges needed to issue Open vSwitch netlink commands (CMD_DEL) can trigger this race, which widens whenever the kernel's memory allocation for the reply is slow; the result is a kernel slab use-after-free confirmed by KASAN that at minimum crashes the host and, per the CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L with C:H/I:H/A:H), could be developed into kernel memory corruption and full local privilege escalation. Affected systems are Linux machines running kernel code with the vulnerable openvswitch flow-deletion path — typically virtualization hosts and SDN data-plane nodes in OpenStack, OVN/Kubernetes, and telecom NFV environments — where an attacker already has local access and OVS administrative rights. The flaw was reported by Trend Micro's Zero Day Initiative (ZDI-CAN-32042), has no public proof of concept, is not in CISA's KEV catalog, and no exploitation in the wild is known. The fix reorders the code so that ovs_flow_tbl_remove() runs only after ovs_flow_cmd_fill_info() has finished using the flow.

Do: Patch to a kernel release containing the upstream fix 'net: openvswitch: fix flow mask use-after-free on flow deletion' (CVE-2026-80994) as soon as your distribution ships it. If the openvswitch kernel module is not needed on a host, blacklist or unload it, and otherwise restrict which local users and containers can reach OVS netlink commands (CAP_NET_ADMIN) since exploitation requires local privileges. Monitor OVS data-plane nodes for kernel oopses or KASAN reports in ovs_flow_cmd_del/ovs_nla_put_key as an indicator of attempted triggering.