[SRU][R/N:hwe-6.17/N/J][PATCH 0/4] CVE-2026-64531

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-64531

[ Impact ]

Open vSwitch stores generated flow actions as netlink attributes, whose
nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove
misbehaving actions length check") allowed the total action stream to
grow past 64 KiB but also removed the last guard preventing a single
generated nested action attribute from exceeding U16_MAX. An oversized
nested container is then closed with a truncated nla_len, so a later
dump or teardown walks a structurally different stream than the one
that was validated. Bytes inside an oversized nested CLONE/CT action
can be re-interpreted as independent actions.

Resolute and hwe-6.17 contain the break via mainline (6.14-rc7). Jammy
and noble picked it up through their upstream stable syncs (5.15.180
and 6.6.84).

[ Fix ]

jammy: clean cherry-pick from linux-5.15.y
noble: clean cherry-pick from linux-6.6.y
resolute: clean cherry-pick from linux-7.1.y
noble/hwe-6.17: clean cherry-pick from mainline

[ Test Plan ]

Build tested only, on amd64.

[ Where Problems Could Occur ]

The change is confined to flow action validation and copy in
net/openvswitch/flow_netlink.c. Nested action close now rejects
containers that do not fit in nla_len and the error is propagated
through all callers. A mistake here could reject valid large flows or
leak tunnel info on the new error paths.