{"id":7450,"date":"2026-09-04T18:49:33","date_gmt":"2026-09-04T10:49:33","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74465"},"modified":"2026-09-04T18:49:33","modified_gmt":"2026-09-04T10:49:33","slug":"cve-2026-74465","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74465","title":{"rendered":"CVE-2026-74465 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: openvswitch: fix potential UAF on meter attach failure<\/p>\n<p>While attaching a newly created meter attach_meter() function makes<br \/>\nthe new meter visible to other CPUs but can still fail afterwards.<br \/>\nOn failure, it detaches the meter back and returns an error.<\/p>\n<p>However, this is an unexpected behavior for the ovs_meter_cmd_set()<br \/>\nthat uses a plain kfree(meter) on attach failure without waiting for<br \/>\nRCU readers to stop using it, assuming it was never visible.<\/p>\n<p>This is never a problem for ovs-vswitchd as it always creates meters<br \/>\nbefore creating any flows that use them.  But the UAF can be triggered<br \/>\nwith a custom application using uAPI:<\/p>\n<p> BUG: KASAN: slab-use-after-free in ovs_meter_execute (net\/openvswitch\/meter.c:653)<br \/>\n Read of size 8 at addr ffff88810d152650 by task meter\/2508<\/p>\n<p> Call Trace:<br \/>\n  ovs_meter_execute (net\/openvswitch\/meter.c:653)<br \/>\n  do_execute_actions (net\/openvswitch\/actions.c:1407)<br \/>\n  ovs_execute_actions (net\/openvswitch\/actions.c:1584)<br \/>\n  ovs_packet_cmd_execute (net\/openvswitch\/datapath.c:703)<br \/>\n  &#8230;<br \/>\n  netlink_sendmsg (af_netlink.c:1900)<\/p>\n<p> Allocated by task 2519:<br \/>\n  __kasan_kmalloc (mm\/kasan\/common.c:398 mm\/kasan\/common.c:415)<br \/>\n  ovs_meter_cmd_set (net\/openvswitch\/meter.c:422)<br \/>\n  &#8230;<br \/>\n  netlink_sendmsg (af_netlink.c:1900)<\/p>\n<p> Freed by task 2519:<br \/>\n  kfree (mm\/slub.c:2705 mm\/slub.c:6405 mm\/slub.c:6720)<br \/>\n  ovs_meter_cmd_set (net\/openvswitch\/meter.c:479)<br \/>\n  &#8230;<br \/>\n  netlink_sendmsg (af_netlink.c:1900)<\/p>\n<p>Fix that by making sure attach_meter() doesn&#8217;t make the meter visible<br \/>\nuntil all the checks are done and the function can&#8217;t fail anymore.<\/p>\n<p>This also makes sure the &#8220;hash&#8221; value is calculated after the potential<br \/>\nre-sizing of the table.<\/p>\n<p>Reported by Trend Micro&#8217;s Zero Day Initiative as ZDI-CAN-31642.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: openvswitch: fix potential UAF on meter attach failure<\/p>\n<p>While attaching a newly created meter attach_meter() function makes<br \/>\nth<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7450","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7450","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7450"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7450"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7450"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}