CVE-2026-89488: Linux Vulnerability (CVSS 7.8)

Description

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovs_mutex. The CT limit pointer was neither removed from readers nor protected by a grace period, allowing packet processing to dereference the freed state. An unprivileged user can trigger this bug from a user and network namespace, causing a slab-use-after-free in ovs_ct_execute() when the netns is torn down. Publish the CT limit pointer through RCU, remove it before teardown, and wait for readers before freeing its contents. Keep ovs_mutex around individual CT limit updates, and use the RCU read-side lock while GET traverses the RCU-protected limit lists. Netns teardown detaches the RCU-protected CT limit state in the pernet .pre_exit callback while holding ovs_mutex. The pernet core guarantees an RCU grace period between the .pre_exit and .exit callbacks, so the .exit callback completes the teardown without adding any extra synchronization. The netlink command handlers do not need NULL checks because the userspace netlink socket holds an active reference to its network namespace while a request is processed. The per-netns exit path therefore cannot run concurrently with SET, DEL, or GET for that socket's namespace.

Metrics

CVSS 3.1

7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.12%

2.4th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= 11efd5cb04a184eea4f57b68ea63dddd463158d1, < 239f26589a6926db28c436e14f28517581ef1385; >= 11efd5cb04a184eea4f57b68ea63dddd463158d1, < 3b9369881b403f4cdbb11fa998554382bdcc3d8c; >= 11efd5cb04a184eea4f57b68ea63dddd463158d1, < 3b41d907400cc1dd1da9555b81dca422b1f44433; >= 11efd5cb04a184eea4f57b68ea63dddd463158d1, < 680f20d5937fa4d1367c59fe83091b78041015f5; >= 11efd5cb04a184eea4f57b68ea63dddd463158d1, < bf4aaa7ea2579e24ed7de2e20578a875bebca011; >= 11efd5cb04a184eea4f57b68ea63dddd463158d1, < e15407c3a8a005324f633cd46cd8fb58042c1157; >= 11efd5cb04a184eea4f57b68ea63dddd463158d1, < 6a6d36fadb8537d9b79e72c9fa51885ec0c33e10; >= 11efd5cb04a184eea4f57b68ea63dddd463158d1, < 403f96c32c9e24600093d7d0c61c17daeedca957
Linux	Linux	4.18

References

Timeline

Published: Sep 11, 2026
Last Modified: Sep 14, 2026
Status: Received

Frequently Asked Questions

What is CVE-2026-89488?

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovs_mutex. The CT limit pointer was neither removed from readers nor protected by a grace period, allowing packet processing to dereference the freed state. An unprivileged user can trigger this bug from a user and network namespace, causing a slab-use-after-free in ovs_ct_execute() when the netns is torn down. Publish the CT limit pointer through RCU, remove it before teardown, and wait for readers before freeing its contents. Keep ovs_mutex around individual CT limit updates, and use the RCU read-side lock while GET traverses the RCU-protected limit lists. Netns teardown detaches the RCU-protected CT limit state in the pernet .pre_exit callback while holding ovs_mutex. The pernet core guarantees an RCU grace period between the .pre_exit and .exit callbacks, so the .exit callback completes the teardown without adding any extra synchronization. The netlink command handlers do not need NULL checks because the userspace netlink socket holds an active reference to its network namespace while a request is processed. The per-netns exit path therefore cannot run concurrently with SET, DEL, or GET for that socket's namespace.

How severe is CVE-2026-89488?

CVE-2026-89488 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.12% probability of exploitation in the next 30 days.

How do I fix CVE-2026-89488?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →