ZDI-26-687: Linux Kernel Open vSwitch Flow Delete Use-After-Free Information Disclosure Vulnerability
ZDI discloses Linux Kernel Open vSwitch use-after-free (CVE-2026-80994) letting low-privileged local attackers disclose sensitive kernel information, CVSS 6.4.
ZDI-26-687 covers a use-after-free information disclosure vulnerability in the Linux Kernel's Open vSwitch flow deletion handling, tracked as CVE-2026-80994 with a CVSS rating of 6.4. Exploitation requires the ability to execute low-privileged code on the target system. The flaw allows local attackers to disclose sensitive information from affected installations.
- CVE-2026-80994, CVSS 6.4, Linux Kernel Open vSwitch
- Use-after-free in flow deletion path
- Local information disclosure requiring low-privileged code execution
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-80994 | Use-After-Free in Linux Kernel Open vSwitch Flow Deletion | 7.8 | — |
From the original article
This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.