In the Linux kernel, the following vulnerability has been resolved:

openvswitch: avoid reallocating confirmed conntrack labels

ovs_ct_get_conn_labels() adds the labels extension when a conntrack
entry does not have one. Confirmed conntracks can be read locklessly,
so adding an extension may reallocate and free the extension block
while another CPU accesses it.

Only add the extension for unconfirmed conntracks. A confirmed
conntrack without labels now fails the caller's label operation instead
of reallocating its extension storage.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00184.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
c2ac667358708d7cce64c78f58af6adf4c1e848b affected < 4371d79ea74407fb992c985b1f94391e35bb8289
c2ac667358708d7cce64c78f58af6adf4c1e848b affected < 7ff688aceada1160331a789385ea146f62fbddf7
c2ac667358708d7cce64c78f58af6adf4c1e848b affected < 05eab8dced6bf4d3009a6eeee16ddac99047dc83
c2ac667358708d7cce64c78f58af6adf4c1e848b affected < 579d87ec1e1e85729a6cb2c25961e58beb78640c
c2ac667358708d7cce64c78f58af6adf4c1e848b affected < 2e6dd889c325abf23821e1459c3ffef59b7f0009
c2ac667358708d7cce64c78f58af6adf4c1e848b affected < d16f089bd700f45d720ce989d5495e1dc3be0cf8
c2ac667358708d7cce64c78f58af6adf4c1e848b affected < 8c9fcc6c33950d3db551af664d1fd3d998bfee56
c2ac667358708d7cce64c78f58af6adf4c1e848b affected < 3f118c8217c109fd13ca61caa301d72c483897ef
Linux Linux affected
Version Status Constraints
4.3 affected —
0 unaffected < 4.3
5.10.271 unaffected ≤ 5.10.*
5.15.222 unaffected ≤ 5.15.*
6.1.189 unaffected ≤ 6.1.*
6.6.158 unaffected ≤ 6.6.*
6.12.112 unaffected ≤ 6.12.*
6.18.54 unaffected ≤ 6.18.*
7.2.8 unaffected ≤ 7.2.*
7.3-rc4 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/05eab8dced6bf4d3009a6eeee16ddac99047dc83 cve-icon cve-icon
https://git.kernel.org/stable/c/2e6dd889c325abf23821e1459c3ffef59b7f0009 cve-icon cve-icon
https://git.kernel.org/stable/c/3f118c8217c109fd13ca61caa301d72c483897ef cve-icon cve-icon
https://git.kernel.org/stable/c/4371d79ea74407fb992c985b1f94391e35bb8289 cve-icon cve-icon
https://git.kernel.org/stable/c/579d87ec1e1e85729a6cb2c25961e58beb78640c cve-icon cve-icon
https://git.kernel.org/stable/c/7ff688aceada1160331a789385ea146f62fbddf7 cve-icon cve-icon
https://git.kernel.org/stable/c/8c9fcc6c33950d3db551af664d1fd3d998bfee56 cve-icon cve-icon
https://git.kernel.org/stable/c/d16f089bd700f45d720ce989d5495e1dc3be0cf8 cve-icon cve-icon
History

Tue, 06 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362

Tue, 06 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovs_ct_get_conn_labels() adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read locklessly, so adding an extension may reallocate and free the extension block while another CPU accesses it. Only add the extension for unconfirmed conntracks. A confirmed conntrack without labels now fails the caller's label operation instead of reallocating its extension storage.
Title openvswitch: avoid reallocating confirmed conntrack labels
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-06T08:45:18.707Z

Reserved: 2026-09-25T10:25:14.331Z

Link: CVE-2026-98251

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-06T09:18:13.567

Modified: 2026-10-06T09:18:13.567

Link: CVE-2026-98251

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T14:30:07Z

Weaknesses