APPLIED: [SRU][R/N:hwe-6.17/N/J][PATCH 0/4] CVE-2026-64531

[Edoardo Canepa]

Applied to R/N/J:linux/master-next and N:linux/hwe-6.17-next. Thanks.

On 7/28/26 22:54, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-64531
>
> [ Impact ]
>
> Open vSwitch stores generated flow actions as netlink attributes, whose
> nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove
> misbehaving actions length check") allowed the total action stream to
> grow past 64 KiB but also removed the last guard preventing a single
> generated nested action attribute from exceeding U16_MAX. An oversized
> nested container is then closed with a truncated nla_len, so a later
> dump or teardown walks a structurally different stream than the one
> that was validated. Bytes inside an oversized nested CLONE/CT action
> can be re-interpreted as independent actions.
>
> Resolute and hwe-6.17 contain the break via mainline (6.14-rc7). Jammy
> and noble picked it up through their upstream stable syncs (5.15.180
> and 6.6.84).
>
> [ Fix ]
>
> jammy: clean cherry-pick from linux-5.15.y
> noble: clean cherry-pick from linux-6.6.y
> resolute: clean cherry-pick from linux-7.1.y
> noble/hwe-6.17: clean cherry-pick from mainline
>
> [ Test Plan ]
>
> Build tested only, on amd64.
>
> [ Where Problems Could Occur ]
>
> The change is confined to flow action validation and copy in
> net/openvswitch/flow_netlink.c. Nested action close now rejects
> containers that do not fit in nla_len and the error is propagated
> through all callers. A mistake here could reject valid large flows or
> leak tunnel info on the new error paths.
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260730/8ebd10a8/attachment.sig>