VulnerabilityPublished 28 May 2026Updated 30 Oct 2026

CVE-2026-46165: Linux kernel · openvswitch: vport: fix self-deadlock on release of tunnel ports

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in c741433f6c8dcdecd1d9549d89053761fd1ea413 : patch Linux kernel soon.

Data as of 30 Oct 2026, 12:49 UTC

Severity

High

Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Patch: Available – fixed in c741433f6c8dcdecd1d9549d89053761fd1ea413, aa69918bd418e700309fdd08509dba324fb24296, 3600033f31b1afa16d73a24905eec9ee1d222b97 +9

Exploitation evidence

Disclosed: evidence found.
CVE published 28 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=6.1.168 <6.1.175 >=6.6.131 <6.6.140 >=6.12.80 <6.12.88 >=6.18.21 <6.18.30 >=6.19.11 <6.20	Fixed in c741433f6c8dcdecd1d9549d89053761fd1ea413 aa69918bd418e700309fdd08509dba324fb24296 3600033f31b1afa16d73a24905eec9ee1d222b97 6522d59fb7de55ce0f0f285d962243ddffebb01f 366c482965c673565ecb8bcfb15d5548f13a6a10 8ae6c15fc473c9ad03b0173330cce9a092c76154 6.20 6.18.30 6.12.88 6.6.140 6.1.175 3df75fff46b1517eb479d8e6b8e3500763715dd0
LinuxLinux	Affected =7.0	Fixed in–
Linuxlinux/kernel`pkg:deb/linux/kernel`Other threats	Affected >=6.1.168 <6.1.175 >=6.6.131 <6.6.140 >=6.12.80 <6.12.88 >=6.18.21 <6.18.30 >=6.19.11 <6.20 =7.0	Fixed in 6.1.175 6.6.140 6.12.88 6.18.30 6.20

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

This vulnerability has been fixed in Linux kernel versions 6.1.175, 6.6.140, 6.12.88, 6.18.30, 6.20, and 7.0. Users and administrators should upgrade to these fixed versions or later to resolve the issue. No additional mitigation is required once patched.

Description

A self-deadlock vulnerability in the Linux kernel's openvswitch vport implementation was fixed. The issue occurs during the release of tunnel ports due to improper ordering of RCU callbacks and RTNL lock release, causing the vport to never be freed and references to never be released, resulting in a deadlock on device removal.

Impact

The vulnerability causes a self-deadlock during the removal of tunnel ports in the openvswitch vport subsystem of the Linux kernel. This deadlock can lead to system instability or hang conditions when devices are deleted, impacting system reliability and availability.

Summary

CVE-2026-46165 addresses a self-deadlock in the Linux kernel's openvswitch vport code. The problem arises because vports are concurrently used and protected by RCU, requiring netdev_put() to be called after the RCU grace period. The current code calls synchronize_net() while holding the RTNL lock, which is detrimental to performance and stability. Moreover, the device deletion process calls rtnl_unlock() which triggers netdev_run_todo() and blocks until all references are released. However, the RCU callback to release the vport is scheduled after rtnl_unlock(), so it never executes, causing a self-deadlock. The fix moves the RCU callback before rtnl_unlock(), ensuring the callback executes during synchronize_net() after RTNL is released, preventing the deadlock.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Oct 2026, 12:36 UTC

Technical details

References

Community reviews

Related threats