PT-2026-52322 · Linux · Linux

Publicado 2026-06-25 · Atualizado 2026-06-25 · CVE-2026-53227

Mitre

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix possible kfree skb of ERR PTR

After the patch in the "Fixes" tag, the allocation of the "reply" skb can happen either before or after locking the ovs mutex.

However, error cleanups still follow the classical reversed order, assuming "reply" is allocated before locking: it is freed after unlocking.

If "reply" allocation happens after locking the mutex and it fails, "reply" is left with an ERR PTR, and execution jumps to the correspondent cleanup stage which will try to free an invalid pointer.

Fix this by setting the pointer to NULL after having saved its error value.

Identificadores relacionados

CVE-2026-53227

Produtos afetados

Linux

Referências · 9

• https://git.kernel.org/stable/c/895d1dd9057cde1687fa0f4286d47ceed0b82997 · Nota
• https://git.kernel.org/stable/c/0bb5b2dc1b90aa7dd1473fc8c4d813a29255ff8d · Nota
• https://git.kernel.org/stable/c/25fdf53698535fe8790237f5a8a9626791429785 · Nota
• https://git.kernel.org/stable/c/ee30dd2909d8b98619f4341c70ec8dc8e155ab02 · Nota
• https://git.kernel.org/stable/c/971b1b37774f13acc5add0a2843f8598446b8598 · Nota
• https://git.kernel.org/stable/c/ecc55aad3390129a87106841f4b68bf3d70c9264 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-53227 · Nota de Segurança
• https://git.kernel.org/stable/c/e248fb2e680deb2bd37bac551b72638fe4938a76 · Nota
• https://git.kernel.org/stable/c/e3d509a1b71396e1452060dbf84a805fd1c3c549 · Nota