CVE-2026-98490
Description
A flaw was found in the Linux kernel's Open vSwitch subsystem. When connection tracking helpers process unconfirmed connections, subsequent memory reallocations for extensions can leave a dangling pointer in the connection expectations list. An attacker can exploit this issue by sending specially crafted network packets to trigger a use-after-free condition, leading to a Denial of Service (DoS) through a kernel crash or potentially arbitrary code execution.
Statement
This vulnerability is rated as an Important severity issue because an unauthenticated remote attacker can trigger a kernel crash by transmitting malformed traffic through networks managed by Open vSwitch. The flaw requires the host to actively process traffic using Open vSwitch connection tracking with protocol helpers enabled, which is not configured by default on standard Red Hat Enterprise Linux deployments. While upstream assigns a Critical rating due to theoretical arbitrary code execution, Red Hat rates the impact as Important because practical exploitation leads to a denial of service via a kernel panic.
Mitigation
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to defer conntrack helper invocation in Open vSwitch until after all connection tracking extensions have been committed and allocated: upgrade to the fixed Kernel/Kernel Rt/Kernel Ivos Qualcomm/Openshift/Ose Rhel Coreos/Kpatch builds, which defer conntrack helper invocation until the end of ovs_ct_commit after all other extensions have been allocated, closing specially crafted network packets targeting conntrack helper flows. Until patched, this is only a concern on Linux systems running Open vSwitch with conntrack helpers and extensions enabled — Non-Linux operating systems are unaffected — so Restrict network traffic to Open vSwitch conntrack helper flows, or avoid combining helper processing with additional extension assignments on unconfirmed connections. As a compensating measure, enable runtime memory error detection such as KASAN or HWASan to detect use-after-free access and dangling pointer dereferences and enable SLAB freelist hardening including freelist randomization and integrity checks to impede exploitation of reallocated extension memory. These controls limit blast radius and contain exploitation, but they do not fix the underlying conntrack helper use-after-free defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1005 Runtime Memory Error Detection (KASAN/HWASan) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
