Linux Kernel OpenVswitch Race Condition Allows Local Privilege Escalation

A race condition vulnerability has been identified within the Linux Kernel's OpenVswitch component, allowing local attackers to escalate their privileges on affected systems. The vulnerability, tracked as ZDI-26-688 and assigned CVE-2026-74465, requires an attacker to first achieve low-privileged code execution on the target system before they can exploit the flaw.

The specific weakness lies in how the OpenVswitch module handles dp_meter objects. The issue stems from a lack of proper locking mechanisms when these objects are being operated upon. This oversight can be exploited by an attacker to bypass intended access controls, leading to privilege escalation and the ability to execute arbitrary code within the context of the kernel.

The Zero Day Initiative (ZDI), which disclosed the vulnerability, has assigned it a CVSS score of 7.8, indicating a high severity. This score reflects the potential impact of a successful exploit, which could grant an attacker complete control over a compromised system.

Linux has released an update to address this vulnerability. The fix is available through a commit in the official Linux kernel repository, specifically commit a58a2b0ce354df531ebc71fc870058c2feb59f6b. Users are strongly advised to apply this update to protect their systems.

The vulnerability was initially reported to the vendor on July 21, 2026. Following a coordinated disclosure process, the advisory was publicly released on September 14, 2026, with an update to the advisory also occurring on the same day. The credit for discovering this vulnerability has been attributed to an anonymous researcher.

This vulnerability highlights the ongoing challenges in securing complex kernel components like OpenVswitch, which are critical for network functionality in many Linux distributions. The need for robust locking and concurrency controls remains paramount to prevent such privilege escalation attacks.

While the exploit requires initial local access, the ability to escalate to kernel-level privileges can have severe consequences, potentially allowing attackers to disable security measures, steal sensitive data, or use the compromised system as a pivot point for further network intrusions.

System administrators should ensure their Linux kernels are updated to the latest patched versions to mitigate the risk posed by CVE-2026-74465. Regular patching and diligent security practices are essential for maintaining the integrity and security of Linux-based infrastructure.

This new advisory, ZDI-26-687, details a separate use-after-free vulnerability within the Linux Kernel's Open vSwitch component, distinct from the race condition described in ZDI-26-688. While both vulnerabilities require prior low-privileged code execution, ZDI-26-687 specifically targets the handling of sw_flow_mask objects and leads to information disclosure rather than privilege escalation.