CVE-2026-64531

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description Open vSwitch stores generated flow actions as nlattrs, which use a nla len field of type u16. A previous change allowed the total sw flow actions stream to exceed 64 KiB but removed the protection preventing a generated nested action attribute from exceeding U16 MAX. This allows an oversized generated container to be closed with a truncated nla len. Consequently, a subsequent dump or teardown process may traverse a structurally different stream than the one originally validated. Specifically, an oversized nested CLONE or CT action can lead to subsequent bytes in the generated stream being incorrectly interpreted as independent actions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.