CVE-2026-74465

A use-after-free vulnerability was found in the Linux kernel's Open vSwitch (OVS) module, which Red Hat Product Security has rated as having a MODERATE impact. When a new meter is attached, the attach_meter() function makes the meter visible to other CPUs before all checks have completed; if the attachment subsequently fails, ovs_meter_cmd_set() frees the meter with a plain kfree() without waiting for RCU readers to finish, so a concurrent packet-execution path can still dereference the freed meter in ovs_meter_execute(). A local attacker with the ability to use the Open vSwitch netlink uAPI, for example through a custom application, could race meter creation with concurrent packet execution to trigger this use-after-free, causing memory corruption that can result in a kernel crash and denial of service, with potential for arbitrary code execution. The standard ovs-vswitchd daemon is not exposed to this issue because it always creates meters before creating any flows that use them. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those kernels; the affected Red Hat Enterprise Linux 8, 9, and 10 kernel and kernel-rt streams, as well as the Red Hat In-Vehicle OS kernels, contain the vulnerable code and their fixes are currently deferred. The residual risk while the fix is deferred is limited: exploitation requires local access and the ability to control OVS meter configuration through the uAPI, and it depends on winning a race between a meter attachment failure and concurrent packet processing. Red Hat rates this issue MODERATE (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while the upstream CVE record assigns 7.8; the difference reflects Red Hat's assessment that the most realistic impact is local denial of service and that exploitation requires local uAPI access via a custom application rather than remote network access.