CVE-2026-64531

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: openvswitch: reject oversized nested action attrs<br /> <br /> Open vSwitch stores generated flow actions as nlattrs, whose nla_len<br /> field is u16. Commit a1e64addf3ff ("net: openvswitch: remove<br /> misbehaving actions length check") allowed the total sw_flow_actions<br /> stream to grow beyond 64 KiB, which is valid, but also removed the last<br /> guard preventing a generated nested action attribute from exceeding<br /> U16_MAX.<br /> <br /> An oversized generated container can thus be closed with a truncated<br /> nla_len. A later dump or teardown then walks a structurally different<br /> stream than the one that was validated. In particular, an oversized<br /> nested CLONE/CT action may cause subsequent bytes in the generated<br /> stream to be interpreted as independent actions.<br /> <br /> Keep the larger total-action-stream behavior, but make nested action<br /> close reject generated containers that do not fit in nla_len, and return<br /> the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and<br /> CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse<br /> construction order before discarding failed wrappers, so resources copied<br /> into the rejected tails are released before the wrappers are removed.<br /> <br /> Most failed outer wrappers are discarded by truncating actions_len after<br /> child resources have been released. CHECK_PKT_LEN also trims its parent<br /> after branch resources are gone. SET/TUNNEL close failures unwind their<br /> known tun_dst ownership directly, and SET_TO_MASKED has no external<br /> ownership and truncates on close failure.