ACK: [SRU][R/N:hwe-6.17/N/J][PATCH 0/4] CVE-2026-64531

[Benjamin Wheeler]

Acked-by: Benjamin Wheeler <benjamin.wheeler at canonical.com>

On Tue, Jul 28, 2026 at 4:55 PM Cengiz Can via kernel-team <
kernel-team at lists.ubuntu.com> wrote:

> https://ubuntu.com/security/CVE-2026-64531
>
> [ Impact ]
>
> Open vSwitch stores generated flow actions as netlink attributes, whose
> nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove
> misbehaving actions length check") allowed the total action stream to
> grow past 64 KiB but also removed the last guard preventing a single
> generated nested action attribute from exceeding U16_MAX. An oversized
> nested container is then closed with a truncated nla_len, so a later
> dump or teardown walks a structurally different stream than the one
> that was validated. Bytes inside an oversized nested CLONE/CT action
> can be re-interpreted as independent actions.
>
> Resolute and hwe-6.17 contain the break via mainline (6.14-rc7). Jammy
> and noble picked it up through their upstream stable syncs (5.15.180
> and 6.6.84).
>
> [ Fix ]
>
> jammy: clean cherry-pick from linux-5.15.y
> noble: clean cherry-pick from linux-6.6.y
> resolute: clean cherry-pick from linux-7.1.y
> noble/hwe-6.17: clean cherry-pick from mainline
>
> [ Test Plan ]
>
> Build tested only, on amd64.
>
> [ Where Problems Could Occur ]
>
> The change is confined to flow action validation and copy in
> net/openvswitch/flow_netlink.c. Nested action close now rejects
> containers that do not fit in nla_len and the error is propagated
> through all callers. A mistake here could reject valid large flows or
> leak tunnel info on the new error paths.
>
> --
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260729/71e76e90/attachment.html>