ACK: [SRU][R/N:hwe-6.17/N/J][PATCH 0/4] CVE-2026-64531

[Tim Whisonant]

On Tue, Jul 28, 2026 at 11:54:48PM +0300, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-64531
> 
> [ Impact ]
> 
> Open vSwitch stores generated flow actions as netlink attributes, whose
> nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove
> misbehaving actions length check") allowed the total action stream to
> grow past 64 KiB but also removed the last guard preventing a single
> generated nested action attribute from exceeding U16_MAX. An oversized
> nested container is then closed with a truncated nla_len, so a later
> dump or teardown walks a structurally different stream than the one
> that was validated. Bytes inside an oversized nested CLONE/CT action
> can be re-interpreted as independent actions.
> 
> Resolute and hwe-6.17 contain the break via mainline (6.14-rc7). Jammy
> and noble picked it up through their upstream stable syncs (5.15.180
> and 6.6.84).
> 
> [ Fix ]
> 
> jammy: clean cherry-pick from linux-5.15.y
> noble: clean cherry-pick from linux-6.6.y
> resolute: clean cherry-pick from linux-7.1.y
> noble/hwe-6.17: clean cherry-pick from mainline
> 
> [ Test Plan ]
> 
> Build tested only, on amd64.
> 
> [ Where Problems Could Occur ]
> 
> The change is confined to flow action validation and copy in
> net/openvswitch/flow_netlink.c. Nested action close now rejects
> containers that do not fit in nla_len and the error is propagated
> through all callers. A mistake here could reject valid large flows or
> leak tunnel info on the new error paths.
> 

Acked-by: Tim Whisonant <tim.whisonant at canonical.com>