CVE-2022-49086

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix leak of nested actions While parsing user-provided actions, openvswitch module may dynamically allocate memory and store pointers in the internal copy of the actions. So this memory has to be freed while destroying the actions. Currently there are only two such actions: ct() and set(). However, there are many actions that can hold nested lists of actions and ovs_nla_free_flow_actions() just jumps over them leaking the memory. For example, removal of the flow with the following actions will lead to a leak of the memory allocated by nf_ct_tmpl_alloc(): actions:clone(ct(commit),0) Non-freed set() action may also leak the 'dst' structure for the tunnel info including device references. Under certain conditions with a high rate of flow rotation that may cause significant memory leak problem (2MB per second in reporter's case). The problem is also hard to mitigate, because the user doesn't have direct control over the datapath flows generated by OVS. Fix that by iterating over all the nested actions and freeing everything that needs to be freed recursively. New build time assertion should protect us from this problem if new actions will be added in the future. Unfortunately, openvswitch module doesn't use NLA_F_NESTED, so all attributes has to be explicitly checked. sample() and clone() actions are mixing extra attributes into the user-provided action list. That prevents some code generalization too.

• CWE-401

• https://git.kernel.org/stable/c/1f30fb9166d4f15a1aa19449b9da871fe0ed4796Patch
• https://git.kernel.org/stable/c/3554c214b83ec9a839ed574263a34218f372990cPatch
• https://git.kernel.org/stable/c/53bce9d19b0a9d245b25cd050b81652ed974a509Patch
• https://git.kernel.org/stable/c/5ae05b5eb58773cfec307ff88aff4cfd843c4cffPatch
• https://git.kernel.org/stable/c/7438dc55c0709819b813f4778aec2c48b782990bPatch
• https://git.kernel.org/stable/c/837b96d8103938e35e7d92cd9db96af914ca4fffPatch
• https://git.kernel.org/stable/c/ef6f9ce0a79aa23b10fc5f3b3cab3814a25aac40Patch

Published

Feb 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-49080In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49081In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49082In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2022-49083In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49084In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49085In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2022-49087In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2022-49088In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49089In the Linux kernel, the following vulnerability has been re…4.7
• CVE-2022-4909Inappropriate implementation in XML in Google Chrome prior t…6.3
• CVE-2022-49090In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49091In the Linux kernel, the following vulnerability has been re…5.5