Answer in brief
CVE-2026-45840 records a Medium severity (CVSS 5.5) vulnerability in openvswitch: cap upcall PID array size and pre-size vport replies. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=5cd667b0a4567048bb555927d6ee564f4e5620a9 <8d59b80e69dddb665eb2de36e62859ab2073470e || >=5cd667b0a4567048bb555927d6ee564f4e5620a9 <d9e47e29aacb9f8a9d59feb6ab5b128a9bbb40b0 || >=5cd667b0a4567048bb555927d6ee564f4e5620a9 <b39f763d720d623218bc1d95ace6855d7b474e81 || >=5cd667b0a4567048bb555927d6ee564f4e5620a9 <f9ef3db77a383d66847fd082c2b437d8ae4d9c63 || >=5cd667b0a4567048bb555927d6ee564f4e5620a9 <f99ac36b5d7c719d08a69fcdecce40f78a874e15 || >=5cd667b0a4567048bb555927d6ee564f4e5620a9 <fa6e90bc443bed8dc0d55bc5ea5b27ffdfe37704 || >=5cd667b0a4567048bb555927d6ee564f4e5620a9 <1d6c02b86329883aa467a3a61f8d34369db73a2f || >=5cd667b0a4567048bb555927d6ee564f4e5620a9 <2091c6aa0df6aba47deb5c8ab232b1cb60af3519 | 8d59b80e69dddb665eb2de36e62859ab2073470e, d9e47e29aacb9f8a9d59feb6ab5b128a9bbb40b0, b39f763d720d623218bc1d95ace6855d7b474e81, f9ef3db77a383d66847fd082c2b437d8ae4d9c63, f99ac36b5d7c719d08a69fcdecce40f78a874e15, fa6e90bc443bed8dc0d55bc5ea5b27ffdfe37704, 1d6c02b86329883aa467a3a61f8d34369db73a2f, 2091c6aa0df6aba47deb5c8ab232b1cb60af3519 |
| Linux/Linuxgeneric | 3.17 | Not reported |
| Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystemgeneric | >=0 <* | * |
Published upstream
May 27, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 26, 2026
In the Linux kernel, the following vulnerability has been resolved: openvswitch: cap upcall PID array size and pre-size vport replies The vport netlink reply helpers allocate a fixed-size skb with nlmsg_new(NLMSG_DEFAULT_SIZE, ...) but serialize the full upcall PID array via ovs_vport_get_upcall_portids(). Since ovs_vport_set_upcall_portids() accepts any non-zero multiple of sizeof(u32) with no upper bound, a CAP_NET_ADMIN user can install a PID array large enough to overflow the reply buffer, causing nla_put() to fail with -EMSGSIZE and hitting BUG_ON(err < 0). On systems with unprivileged user namespaces enabled (e.g., Ubuntu default), this is reachable via unshare -Urn since OVS vport mutation operations use GENL_UNS_ADMIN_PERM. kernel BUG at net/openvswitch/datapath.c:2414! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 1 UID: 0 PID: 65 Comm: poc Not tainted 7.0.0-rc7-00195-geb216e422044 #1 RIP: 0010:ovs_vport_cmd_set+0x34c/0x400 Call Trace: <TASK> genl_family_rcv_msg_doit (net/netlink/genetlink.c:1116) genl_rcv_msg (net/netlink/genetlink.c:1194) netlink_rcv_skb (net/netlink/af_netlink.c:2550) genl_rcv (net/netlink/genetlink.c:1219) netlink_unicast (net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) __sys_sendto (net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64 (arch/x86/entry/syscall_64.c:63) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> Kernel panic - not syncing: Fatal exception Reject attempts to set more PIDs than nr_cpu_ids in ovs_vport_set_upcall_portids(), and pre-compute the worst-case reply size in ovs_vport_cmd_msg_size() based on that bound, similar to the existing ovs_dp_cmd_msg_size(). nr_cpu_ids matches the cap already used by the per-CPU dispatch configuration on the datapath side (ovs_dp_cmd_fill_info() serialises at most nr_cpu_ids PIDs), so the two sides stay consistent.
Quoted source text, attributed separately from HOL analysis.