CVE-2026-74465

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: openvswitch: fix potential UAF on meter attach failure<br /> <br /> While attaching a newly created meter attach_meter() function makes<br /> the new meter visible to other CPUs but can still fail afterwards.<br /> On failure, it detaches the meter back and returns an error.<br /> <br /> However, this is an unexpected behavior for the ovs_meter_cmd_set()<br /> that uses a plain kfree(meter) on attach failure without waiting for<br /> RCU readers to stop using it, assuming it was never visible.<br /> <br /> This is never a problem for ovs-vswitchd as it always creates meters<br /> before creating any flows that use them. But the UAF can be triggered<br /> with a custom application using uAPI:<br /> <br /> BUG: KASAN: slab-use-after-free in ovs_meter_execute (net/openvswitch/meter.c:653)<br /> Read of size 8 at addr ffff88810d152650 by task meter/2508<br /> <br /> Call Trace:<br /> ovs_meter_execute (net/openvswitch/meter.c:653)<br /> do_execute_actions (net/openvswitch/actions.c:1407)<br /> ovs_execute_actions (net/openvswitch/actions.c:1584)<br /> ovs_packet_cmd_execute (net/openvswitch/datapath.c:703)<br /> ...<br /> netlink_sendmsg (af_netlink.c:1900)<br /> <br /> Allocated by task 2519:<br /> __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)<br /> ovs_meter_cmd_set (net/openvswitch/meter.c:422)<br /> ...<br /> netlink_sendmsg (af_netlink.c:1900)<br /> <br /> Freed by task 2519:<br /> kfree (mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720)<br /> ovs_meter_cmd_set (net/openvswitch/meter.c:479)<br /> ...<br /> netlink_sendmsg (af_netlink.c:1900)<br /> <br /> Fix that by making sure attach_meter() doesn&amp;#39;t make the meter visible<br /> until all the checks are done and the function can&amp;#39;t fail anymore.<br /> <br /> This also makes sure the "hash" value is calculated after the potential<br /> re-sizing of the table.<br /> <br /> Reported by Trend Micro&amp;#39;s Zero Day Initiative as ZDI-CAN-31642.