CVE-2026-99025 Linux CVE debrief

Who should care

Linux system administrators, security teams, and operators managing Linux kernel-based systems should assess exposure and verify if their systems are affected by checking the Linux kernel version and openvswitch configuration. This includes teams responsible for vulnerability management, platform security, and ensuring the stability of production compute nodes.

Why it matters

Defenders should prioritize patching or mitigating this vulnerability to prevent potential system crashes. Linux system administrators and security teams should assess exposure and verify if their systems are affected by checking the Linux kernel version and openvswitch configuration.

• Potential system crashes due to soft lockup
• Increased CPU usage due to softirq engine

Technical summary

The vulnerability is caused by ovs_flow_cmd_dump() calling ovs_flow_stats_get() for every flow it emits, releasing stats->lock with spin_unlock_bh() once per CPU that has touched the flow. This can lead to a soft lockup when the dumping thread becomes the CPU's softirq engine and never sleeps. The fix involves holding BH off across the whole callback in ovs_flow_cmd_dump(), similar to ctnetlink_dump_table(). Linux system administrators should assess exposure and verify if their systems are affected by checking the Linux kernel version and openvswitch configuration.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability to prevent potential system crashes. Linux system administrators and security teams should assess exposure and verify if their systems are affected by checking the Linux kernel version and openvswitch configuration.

Recommended defensive actions

• Patch or upgrade to a fixed Linux kernel version
• Verify system exposure by checking Linux kernel version and openvswitch configuration
• Monitor system logs for potential soft lockup issues
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was resolved by holding BH off across the whole callback in ovs_flow_cmd_dump(), similar to ctnetlink_dump_table(). The fix involves modifying the openvswitch code to prevent the soft lockup.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.