High [CVE-2026-64531] reject oversized nested action attrs
This high-severity Red Hat Linux advisory covers CVE-2026-64531 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Red Hat Linux publishes the next one.
VulniPulse checks Red Hat Linux's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
Summary
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16.
Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len.
A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions.
Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers.
For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed.
Most failed outer wrappers are discarded by truncating actions_len after child resources have been released.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative. Check it before change work.
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
- kernel-0:6.12.0-211.46.1.el10_2
- kpatch-patch
- kernel-0:5.14.0-687.38.1.el9_8
- kernel-0:5.14.0-284.186.1.el9_2
- kernel-rt-0:5.14.0-284.186.1.rt14.471.el9_2
- kernel-0:5.14.0-427.143.1.el9_4
- rhcos-414.92.202608172040-0
- rhcos-416.94.202608150307-0
- rhcos-418.94.202608142238-0
- rhcos-4.22.9.8.202608191915-0
- RHSA-2026:53330
- RHSA-2026:59143
- RHSA-2026:53329
- RHSA-2026:59149
- RHSA-2026:51603
- RHSA-2026:51604
- RHSA-2026:59147
- RHSA-2026:51746
- RHSA-2026:59145
- RHSA-2026:56786
- RHSA-2026:56853
- RHSA-2026:57483
- RHSA-2026:57362
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
Mitigation checklist
- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. If OVS is not required on a given system, unloading the openvswitch module (`modprobe -r openvswitch`) eliminates the attack surface entirely. For systems that require OVS but cannot patch immediately, the single most effective mitigation is disabling unprivileged user namespaces (`sysctl -w user.max_user_namespaces=0`), which blocks the primary path an unprivileged attacker uses to obtain CAP_NET_ADMIN and reach the vulnerable netlink interface. Standard kernel hardening (KASLR, SMEP, SMAP, kptr_restrict) is enabled by default on supported RHEL kernels and significantly increases exploitation complexity, but these controls are defense-in-depth and not a substitute for patching or removing the vulnerable module.
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
More Red Hat Linux advisories
- CVE-2026-46300May 13, 2026"Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local
- CVE-2026-31431Apr 22, 2026algif_aead - Revert to operating out-of-place
- CVE-2026-34486Apr 9, 2026Missing Encryption of Sensitive Data due to EncryptInterceptor bypass
- CVE-2026-111497Oct 22, 2026Out-of-Bounds Write in Google Brotli Decoder
- CVE-2026-109619Oct 21, 2026fatal error handling retains stale request state leading to use-after-free
- CVE-2026-109618Oct 21, 2026OOM bailout during request parsing leads to memory corruption and RCE
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.