Medium 5.5Published May 28, 2026

CVE-2026-46165openvswitch: vport: fix self-deadlock on release of tunnel ports

Updated under an hour ago (Oct 27, 2026, 8:00 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: openvswitch: vport: fix self-deadlock on release of tunnel ports vports are used concurrently and protected by RCU, so netdev_put() must happen after the RCU grace period. So, either in an RCU call or after the synchronize_net(). The rtnl_delete_link() must happen under RTNL and so can't be executed in RCU context. Calling synchronize_net() while holding RTNL is not a good idea for performance and system stability under load in general, so calling netdev_put() in RCU call is the right solution here. However, when the device is deleted, rtnl_unlock() will call netdev_run_todo() and block until all the references are gone. In the current code this means that we never reach the call_rcu() and the vport is never freed and the reference is never released, causing a self-deadlock on device removal. Fix that by moving the rcu_call() before the rtnl_unlock(), so the scheduled RCU callback will be executed when synchronize_net() is called from the rtnl_unlock()->netdev_run_todo() while the RTNL itself is already released.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	9d56aced21fb9c104e8a3f3be9b21fbafe448ffc builds before 8ae6c15fc473c9ad03b0173330cce9a092c76154; from 42f0d3d81209654c08ffdde5a34b9b92d2645896 before c741433f6c8dcdecd1d9549d89053761fd1ea413; from bbe7bd722bfaea36aab3da6cc60fb4a05c644643 before 6522d59fb7de55ce0f0f285d962243ddffebb01f; 98b726ab5e2a4811e27c28e4d041f75bba147eab builds before 3df75fff46b1517eb479d8e6b8e3500763715dd0; 6931d21f87bc6d657f145798fad0bf077b82486c builds before 366c482965c673565ecb8bcfb15d5548f13a6a10; from 6931d21f87bc6d657f145798fad0bf077b82486c before aa69918bd418e700309fdd08509dba324fb24296; b8c56a3fc5d879c0928f207a756b0f067f06c6a8; from 6.1.168 before 6.1.175; and 4 more ranges	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 6.1.168 before 6.1.175; from 6.6.131 before 6.6.140; from 6.12.80 before 6.12.88; from 6.18.21 before 6.18.30; from 6.19.11 before 7.0; from 7.0.1 before 7.0.7; 7.0; 7.0; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/8ae6c15fc473c9ad03b0173330cce9a092c76154	patch
https://git.kernel.org/stable/c/c741433f6c8dcdecd1d9549d89053761fd1ea413	patch
https://git.kernel.org/stable/c/6522d59fb7de55ce0f0f285d962243ddffebb01f	patch
https://git.kernel.org/stable/c/3df75fff46b1517eb479d8e6b8e3500763715dd0	patch
https://git.kernel.org/stable/c/366c482965c673565ecb8bcfb15d5548f13a6a10	patch
https://git.kernel.org/stable/c/aa69918bd418e700309fdd08509dba324fb24296	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.