# CVE-2026-45840: openvswitch: cap upcall PID array size and pre-size vport replies

Status: published. Published: 2026-05-27. Updated: 2026-11-06.

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: cap upcall PID array size and pre-size vport replies

The vport netlink reply helpers allocate a fixed-size skb with
nlmsg_new(NLMSG_DEFAULT_SIZE, ...) but serialize the full upcall PID
array via ovs_vport_get_upcall_portids().  Since
ovs_vport_set_upcall_portids() accepts any non-zero multiple of
sizeof(u32) with no upper bound, a CAP_NET_ADMIN user can install a PID
array large enough to overflow the reply buffer, causing nla_put() to
fail with -EMSGSIZE and hitting BUG_ON(err < 0).  On systems with
unprivileged user namespaces enabled (e.g., Ubuntu default), this is
reachable via unshare -Urn since OVS vport mutation operations use
GENL_UNS_ADMIN_PERM.

 kernel BUG at net/openvswitch/datapath.c:2414!
 Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
 CPU: 1 UID: 0 PID: 65 Comm: poc Not tainted 7.0.0-rc7-00195-geb216e422044 #1
 RIP: 0010:ovs_vport_cmd_set+0x34c/0x400
 Call Trace:
  <TASK>
  genl_family_rcv_msg_doit (net/netlink/genetlink.c:1116)
  genl_rcv_msg (net/netlink/genetlink.c:1194)
  netlink_rcv_skb (net/netlink/af_netlink.c:2550)
  genl_rcv (net/netlink/genetlink.c:1219)
  netlink_unicast (net/netlink/af_netlink.c:1344)
  netlink_sendmsg (net/netlink/af_netlink.c:1894)
  __sys_sendto (net/socket.c:2206)
  __x64_sys_sendto (net/socket.c:2209)
  do_syscall_64 (arch/x86/entry/syscall_64.c:63)
  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
  </TASK>
 Kernel panic - not syncing: Fatal exception

Reject attempts to set more PIDs than nr_cpu_ids in
ovs_vport_set_upcall_portids(), and pre-compute the worst-case reply
size in ovs_vport_cmd_msg_size() based on that bound, similar to the
existing ovs_dp_cmd_msg_size().  nr_cpu_ids matches the cap already
used by the per-CPU dispatch configuration on the datapath side
(ovs_dp_cmd_fill_info() serialises at most nr_cpu_ids PIDs), so the
two sides stay consistent.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Linux / Linux: ≥ 5cd667b0a4567048bb555927d6ee564f4e5620a9; < 8d59b80e69dddb665eb2de36e62859ab2073470e (affected, git); ≥ 5cd667b0a4567048bb555927d6ee564f4e5620a9; < d9e47e29aacb9f8a9d59feb6ab5b128a9bbb40b0 (affected, git); ≥ 5cd667b0a4567048bb555927d6ee564f4e5620a9; < b39f763d720d623218bc1d95ace6855d7b474e81 (affected, git); ≥ 5cd667b0a4567048bb555927d6ee564f4e5620a9; < f9ef3db77a383d66847fd082c2b437d8ae4d9c63 (affected, git); ≥ 5cd667b0a4567048bb555927d6ee564f4e5620a9; < f99ac36b5d7c719d08a69fcdecce40f78a874e15 (affected, git); ≥ 5cd667b0a4567048bb555927d6ee564f4e5620a9; < fa6e90bc443bed8dc0d55bc5ea5b27ffdfe37704 (affected, git); ≥ 5cd667b0a4567048bb555927d6ee564f4e5620a9; < 1d6c02b86329883aa467a3a61f8d34369db73a2f (affected, git); ≥ 5cd667b0a4567048bb555927d6ee564f4e5620a9; < 2091c6aa0df6aba47deb5c8ab232b1cb60af3519 (affected, git). Source: CNA: Linux
- Linux / Linux: 3.17 (affected); ≥ 0; < 3.17 (unaffected, semver); ≥ 5.10.258; ≤ 5.10.* (unaffected, semver); ≥ 5.15.209; ≤ 5.15.* (unaffected, semver); ≥ 6.1.175; ≤ 6.1.* (unaffected, semver); ≥ 6.6.141; ≤ 6.6.* (unaffected, semver); ≥ 6.12.91; ≤ 6.12.* (unaffected, semver); ≥ 6.18.33; ≤ 6.18.* (unaffected, semver); ≥ 7.0.10; ≤ 7.0.* (unaffected, semver); ≥ 7.1; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux
- Siemens / SIMATIC S7-1500 TM MFP - GNU/Linux subsystem: ≥ 0; < * (affected, custom). Source: ADP: siemens-SADP

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: 0.13% as of 2026-11-06; percentile 2.80%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/8d59b80e69dddb665eb2de36e62859ab2073470e (CNA: Linux)

- https://git.kernel.org/stable/c/d9e47e29aacb9f8a9d59feb6ab5b128a9bbb40b0 (CNA: Linux)

- https://git.kernel.org/stable/c/b39f763d720d623218bc1d95ace6855d7b474e81 (CNA: Linux)

- https://git.kernel.org/stable/c/f9ef3db77a383d66847fd082c2b437d8ae4d9c63 (CNA: Linux)

- https://git.kernel.org/stable/c/f99ac36b5d7c719d08a69fcdecce40f78a874e15 (CNA: Linux)

- https://git.kernel.org/stable/c/fa6e90bc443bed8dc0d55bc5ea5b27ffdfe37704 (CNA: Linux)

- https://git.kernel.org/stable/c/1d6c02b86329883aa467a3a61f8d34369db73a2f (CNA: Linux)

- https://git.kernel.org/stable/c/2091c6aa0df6aba47deb5c8ab232b1cb60af3519 (CNA: Linux)

- https://cert-portal.siemens.com/productcert/html/ssa-784472.html (ADP: siemens-SADP)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2026-45840; retrieved 2026-11-06; source updated 2026-11-06

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-45840; retrieved 2026-11-06; source updated Not reported

Revision: 77e23c0c003bee4179a75674fe2337a462ce0eed0b3617f4a528b25a69d13aa7

Canonical: https://y2.dev/cve/CVE-2026-45840

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.