In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix possible kfree_skb of ERR_PTR After the patch in the… (CVE-2026-53227)
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix possible kfree_skb of ERR_PTR After the patch in the "Fixes" tag, the allocation of the "reply" skb can happen either before or after locking the ovs_mutex. However, error cleanups still follow the classical reversed order, assuming "reply" is allocated before locking: it is freed after unlocking. If "reply" allocation happens after locking the mutex and it fails, "reply" is left with an ERR_PTR, and execution jumps to the correspondent cleanup stage which will try to free an invalid pointer. Fix this by setting the pointer to NULL after having saved its error value.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel openvswitch code arises from inconsistent error handling when allocating the 'reply' skb buffer. After a patch changed the order of allocation relative to locking the ovs_mutex, error cleanup code still assumes allocation happens before locking. If allocation fails after locking, 'reply' holds an ERR_PTR, which is incorrectly freed during cleanup, causing a use-after-free scenario. The fix involves setting the pointer to NULL after saving the error value to prevent freeing an invalid pointer.
Potential Impact
This vulnerability can cause a denial of service (kernel crash) due to freeing an invalid pointer in the kernel space. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid triggering the vulnerable code path or apply any vendor-provided workarounds. Monitor vendor channels for updates.
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix possible kfree_skb of ERR_PTR After the patch in the… (CVE-2026-53227)
Description
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix possible kfree_skb of ERR_PTR After the patch in the "Fixes" tag, the allocation of the "reply" skb can happen either before or after locking the ovs_mutex. However, error cleanups still follow the classical reversed order, assuming "reply" is allocated before locking: it is freed after unlocking. If "reply" allocation happens after locking the mutex and it fails, "reply" is left with an ERR_PTR, and execution jumps to the correspondent cleanup stage which will try to free an invalid pointer. Fix this by setting the pointer to NULL after having saved its error value.
CVSS v3.1
Score 5.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel openvswitch code arises from inconsistent error handling when allocating the 'reply' skb buffer. After a patch changed the order of allocation relative to locking the ovs_mutex, error cleanup code still assumes allocation happens before locking. If allocation fails after locking, 'reply' holds an ERR_PTR, which is incorrectly freed during cleanup, causing a use-after-free scenario. The fix involves setting the pointer to NULL after saving the error value to prevent freeing an invalid pointer.
Potential Impact
This vulnerability can cause a denial of service (kernel crash) due to freeing an invalid pointer in the kernel space. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid triggering the vulnerable code path or apply any vendor-provided workarounds. Monitor vendor channels for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-mp79-8qq6-qp9g
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53227"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a46eca827e9c7971943a5d6
Added to database: 07/02/2026, 22:56:40 UTC
Last enriched: 07/02/2026, 23:01:12 UTC
Last updated: 07/31/2026, 19:24:47 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.