https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 11:35:18 +0000 https://vulnerability.circl.lu/vuln/cve-2025-40254 <p><strong>Affected:</strong> Linux, Siemens RUGGEDCOM RST2428P</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: openvswitch: remove never-working support for setting nsh fields</p> <p>The validation of the set(nsh(...)) action is completely wrong. It runs through the nsh_key_put_from_nlattr() function that is the same function that validates NSH keys for the flow match and the push_nsh() action. However, the set(nsh(...)) has a very different memory layout. Nested attributes in there are doubled in size in case of the masked set(). That makes proper validation impossible.</p> <p>There is also confusion in the code between the &#39;masked&#39; flag, that says that the nested attributes are doubled in size containing both the value and the mask, and the &#39;is_mask&#39; that says that the value we&#39;re parsing is the mask. This is causing kernel crash on trying to write into mask part of the match with SW_FLOW_KEY_PUT() during validation, while validate_nsh() doesn&#39;t allocate any memory for it:</p> <p>BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 1c2383067 P4D 1c2383067 PUD 20b703067 PMD 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 8 UID: 0 Kdump: loaded Not tainted 6.17.0-rc4+ #107 PREEMPT(voluntary) RIP: 0010:nsh_key_put_from_nlattr+0x19d/0x610 [openvswitch] Call Trace: &lt;TASK&gt; validate_nsh+0x60/0x90 [openvswitch] validate_set.constprop.0+0x270/0x3c0 [openvswitch] __ovs_nla_copy_actions+0x477/0x860 [openvswitch]…</p> <p><strong>Affected:</strong> Linux, Siemens RUGGEDCOM RST2428P</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: openvswitch: remove never-working support for setting nsh fields</p> <p>The validation of the set(nsh(...)) action is completely wrong. It runs through the nsh_key_put_from_nlattr() function that is the same function that validates NSH keys for the flow match and the push_nsh() action. However, the set(nsh(...)) has a very different memory layout. Nested attributes in there are doubled in size in case of the masked set(). That makes proper validation impossible.</p> <p>There is also confusion in the code between the &#39;masked&#39; flag, that says that the nested attributes are doubled in size containing both the value and the mask, and the &#39;is_mask&#39; that says that the value we&#39;re parsing is the mask. This is causing kernel crash on trying to write into mask part of the match with SW_FLOW_KEY_PUT() during validation, while validate_nsh() doesn&#39;t allocate any memory for it:</p> <p>BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 1c2383067 P4D 1c2383067 PUD 20b703067 PMD 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 8 UID: 0 Kdump: loaded Not tainted 6.17.0-rc4+ #107 PREEMPT(voluntary) RIP: 0010:nsh_key_put_from_nlattr+0x19d/0x610 [openvswitch] Call Trace: &lt;TASK&gt; validate_nsh+0x60/0x90 [openvswitch] validate_set.constprop.0+0x270/0x3c0 [openvswitch] __ovs_nla_copy_actions+0x477/0x860 [openvswitch]…</p> https://vulnerability.circl.lu/vuln/cve-2025-40254