CVE-2026-97611 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and users of Open vSwitch should assess exposure and prioritize verification of affected systems. The vulnerability has been publicly disclosed, and Linux kernel developers and administrators should assess exposure and prioritize verification of affected systems. This includes reviewing Linux kernel versions and Open vSwitch configurations for potential exposure, verifying system logs for signs of exploitation, and

Why it matters

A use-after-free vulnerability in the Linux kernel's Open vSwitch flow table mask array handling has been addressed. Linux kernel developers and administrators should assess exposure and prioritize verification of affected systems.

• Potential system crashes or instability
• Possible data corruption or loss
• Verification of affected systems and kernel versions is necessary

Technical summary

The vulnerability occurs in the tbl_mask_array_realloc function, which retires the old mask array before it is no longer reachable. This allows a reader to access the old array after it has been freed, resulting in a use-after-free vulnerability. The vulnerability has been publicly disclosed, and Linux kernel developers and administrators should assess exposure and prioritize verification of affected systems. The vulnerability was resolved in the Linux kernel, and the CVE record and NVD entry provide details on the vulnerability.

Defensive priority

Linux kernel developers and administrators should assess exposure and prioritize verification of affected systems.

Recommended defensive actions

• Review Linux kernel versions and Open vSwitch configurations for potential exposure
• Verify system logs for signs of exploitation
• Apply kernel updates when available
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability was resolved in the Linux kernel. The CVE record and NVD entry provide details on the vulnerability. Evidence of the vulnerability's existence and impact is limited, and defenders should verify affected systems and kernel versions. The vulnerability has been publicly disclosed, and Linux kernel developers and administrators should assess exposure and prioritize verification of affected systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.