In the Linux kernel, the following vulnerability has been resolved:
Revert "openvswitch: switch to per-action label counting in conntrack"
Currently, ovs_ct_set_labels() is only called for confirmed conntrack entries (ct) within ovs_ct_commit(). However, if the conntrack entry does not have the labels_ext extension, attempting to allocate it in ovs_ct_get_conn_labels() for a confirmed entry triggers a warning in nf_ct_ext_add():
WARN_ON(nf_ct_is_confirmed(ct));
This happens when the conntrack entry is created externally before OVS increments net->ct.labels_used. The issue has become more likely since commit fcb1aa5163b1 ("openvswitch: switch to per-action label counting in conntrack"), which changed to use per-action label counting and increment net->ct.labels_used when a flow with ct action is added.
Since there’s no straightforward way to fully resolve this issue at the moment, this reverts the commit to avoid breaking existing use cases.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | — | Jul 9, 2025 | Apr 1, 2025 |
| Suse | — | Upgrade kernel-default-livepatchUpgrade kernel-64kb-develUpgrade kernel-64kbUpgrade kernel-devel-azureUpgrade kernel-default-extraUpgrade kernel-obs-qaUpgrade kernel-develUpgrade kernel-docs-htmlUpgrade kernel-sourceUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmallUpgrade kernel-azure-extraUpgrade kernel-default-develUpgrade kernel-source-azureUpgrade kernel-symsUpgrade kernel-macrosUpgrade kernel-docsUpgrade kernel-default-vdsoUpgrade kernel-azure-develUpgrade kernel-azureUpgrade kernel-defaultUpgrade kernel-64kb-extraUpgrade kernel-azure-vdsoUpgrade kernel-source-vanillaUpgrade kernel-kvmsmall-vdso | Dec 5, 2025 | Dec 5, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub