CVE-2026-74664

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: openvswitch: reallocate update replies for mismatched IDs<br /> <br /> ovs_flow_cmd_new() preallocates the optional reply skb before it takes<br /> ovs_mutex and before it knows which existing flow will be updated.<br /> <br /> That is normally fine because the skb is sized from the request flow<br /> identifier. That identifier also becomes the inserted flow&amp;#39;s identifier.<br /> For updates, however, a request with a UFID may miss the UFID lookup and<br /> then fall back to the flow key lookup. That lookup can legitimately find<br /> an existing key-identified flow. UFIDs are optional and the flow key is<br /> the primary identifier.<br /> <br /> For echoed replies, ovs_flow_cmd_fill_info() writes the matched flow&amp;#39;s<br /> identifier, not the request identifier used for the preallocation. A short<br /> request UFID can therefore leave too little room for the key identifier.<br /> The fill can then fail with -EMSGSIZE and hit the BUG_ON(error