CVE-2026-74464 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: fix skb leak on flow key update failure during ct
ovs_ct_execute() always steals or frees the skb on failure while ovs_flow_key_update() does not. So, if it fails and we return right away, the skb ends up leaked.
Fix that by breaking instead and letting the common error handling code at the bottom of the loop to free the skb properly.
This is a very unlikely scenario as it requires the packet to become unparseable by applying a set of actions on a previously parseable skb, but should be fixed nevertheless.
Reported by Sashiko.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/16/2026
The vulnerability described represents a memory leak condition within the Linux kernel's OpenVSwitch implementation that occurs during connection tracking operations. This issue specifically affects the ovs_ct_execute() function which handles connection tracking for network packets processed through the OpenVSwitch framework. The problem manifests when a flow key update operation fails during the connection tracking process, creating a scenario where network packet buffers become unreleased in memory.
The technical flaw stems from inconsistent error handling patterns between two related functions within the OpenVSwitch codebase. While ovs_ct_execute() properly manages packet buffer lifecycle by either stealing or freeing the socket buffer (skb) on failure conditions, the ovs_flow_key_update() function does not implement this same protective mechanism. When ovs_flow_key_update() fails during connection tracking operations, it returns immediately without ensuring proper cleanup of the associated packet buffer, leading to a memory leak scenario.
This vulnerability operates at the network packet processing layer within the kernel's virtual switch implementation and represents a classic case of resource management inconsistency. The flaw is classified under CWE-404 as improper resource release or unmanaged resource consumption, specifically involving socket buffer memory leaks in kernel space networking code. The operational impact is particularly subtle since it requires very specific conditions to manifest - namely that a previously parseable packet must become unparseable after applying a set of actions during connection tracking processing.
The vulnerability demonstrates a common pattern in kernel networking code where error handling paths are not uniformly implemented across related functions, creating potential for resource exhaustion under sustained attack conditions. The fix implements a structured approach by introducing a break statement instead of immediate return, allowing the existing error handling code at the function's loop bottom to properly manage the packet buffer cleanup. This approach aligns with ATT&CK technique T1070.004 for bypassing defenses through kernel-level memory corruption patterns.
The reported scenario requires an attacker to craft specific packet sequences that would cause previously parseable network traffic to become unparseable during connection tracking processing, making this vulnerability extremely unlikely to be exploited in practice. However, the fix addresses a fundamental resource management issue that could potentially contribute to system instability or performance degradation over time. The vulnerability affects systems running Linux kernels with OpenVSwitch implementations, particularly those handling high volumes of network traffic where memory conservation is critical.
This type of vulnerability highlights the importance of consistent error handling patterns in kernel networking code and demonstrates how seemingly minor inconsistencies can lead to resource management issues. The fix ensures proper cleanup through established kernel programming practices while maintaining the integrity of the connection tracking functionality. The solution prevents potential accumulation of leaked packet buffers that could eventually impact system performance or memory availability, particularly in high-throughput network environments where OpenVSwitch is actively processing large volumes of traffic.