CVE-2026-64531 Linux CVE debrief

Who should care

Users of the Linux kernel, particularly those using Open vSwitch, should be aware of this vulnerability and review the provided patches to ensure their systems are updated. This vulnerability may impact operators, platforms, and security teams responsible for maintaining and securing Linux kernel-based systems.

Technical summary

The Linux kernel's Open vSwitch module stores generated flow actions as nlattrs with a u16 nla_len field. A previous commit allowed the total sw_flow_actions stream to grow beyond 64 KiB but removed the last guard preventing oversized generated nested action attributes. An attacker could exploit this by creating an oversized generated container, which could be closed with a truncated nla_len, leading to structurally different streams being walked during validation and teardown. The fix ensures that nested action close rejects generated containers that do not fit in nla_len.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Ensure Open vSwitch is configured securely
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-27T08:16:22.243Z and has not been modified since then. The Linux kernel's Open vSwitch module stores generated flow actions as nlattrs with a u16 nla_len field. A previous commit allowed the total sw_flow_actions stream to grow beyond 64 KiB but removed the last guard preventing oversized generated nested action attributes. Evidence limits suggest that further details may be required to fully understand the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.