CVE-2026-53227
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix possible…
- Risk score
- 49/100
- CVSS
- 5.5 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 25 Jun 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix possible kfree_skb of ERR_PTR After the patch in the "Fixes" tag, the allocation of the "reply" skb can happen either before or after locking the ovs_mutex. However, error cleanups still follow the classical reversed order, assum…
- Affected
- Linux kernel
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Linux kernel: Amber, patch this week. In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6_srh_rcv() runs with skb->data at the Segment Routing Header (SRH) while skb_network_header() points at the IPv6 header. When segments_left > 0, ipv6_srh_rcv() previously restored the …
The flaws
- CVE-2026-53227: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix possible… (CVSS 5.5 · EPSS 0%)
- CVE-2026-98096: Out-of-bounds write (CVSS 7.4 · EPSS 1%)
- CVE-2026-98115: Race condition (CVSS 8.8 · EPSS 0%)
- CVE-2026-98117: Use-after-free (CVSS 7.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Linux kernel
Where it stands
- No known exploitation
How it unfolded
- 6 Nov, Ubuntu security notices (official): USN-9002-1: Linux kernel (NVIDIA Tegra) vulnerabilities
Connects to
- Same weakness: CWE-401 (CWE-401). 48 other warnings in 30 days
- Same product: Earlier Linux kernel warnings. 176 in the last 90 days
Why it is Yellow
- CVSS 5.5 medium
- On your watchlist: linux kernel
- Named in a government or vendor bulletin
Government and vendor bulletins
References
- https://ubuntu.com/security/notices/USN-9002-1
- https://git.kernel.org/stable/c/0bb5b2dc1b90aa7dd1473fc8c4d813a29255ff8d
- https://git.kernel.org/stable/c/25fdf53698535fe8790237f5a8a9626791429785
- https://git.kernel.org/stable/c/895d1dd9057cde1687fa0f4286d47ceed0b82997
- https://git.kernel.org/stable/c/971b1b37774f13acc5add0a2843f8598446b8598
- https://git.kernel.org/stable/c/e248fb2e680deb2bd37bac551b72638fe4938a76
- https://git.kernel.org/stable/c/e3d509a1b71396e1452060dbf84a805fd1c3c549
- https://git.kernel.org/stable/c/ecc55aad3390129a87106841f4b68bf3d70c9264
- https://git.kernel.org/stable/c/ee30dd2909d8b98619f4341c70ec8dc8e155ab02
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
Original description
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix possible kfree_skb of ERR_PTR After the patch in the "Fixes" tag, the allocation of the "reply" skb can happen either before or after locking the ovs_mutex. However, error cleanups still follow the classical reversed order, assuming "reply" is allocated before locking: it is freed after unlocking. If "reply" allocation happens after locking the mutex and it fails, "reply" is left with an ERR_PTR, and execution jumps to the correspondent cleanup stage which will try to free an invalid pointer. Fix this by setting the pointer to NULL after having saved its error value.
Last activity 6 Nov 2026. Patch Forecast updates every hour.