{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net: openvswitch: fix use-after-free of the flow table mask array  tbl_mask_array_realloc() retires the old mask_array before it stops being reachable:  \told = ovsl_dereference(tbl-\u003emask_array); \tif (old) { \t\t... \t\tcall_rcu(\u0026old-\u003ercu, mask_array_rcu_cb); \t}  \trcu_assign_pointer(tbl-\u003emask_array, new);  call_rcu() only waits for read-side critical sections already in flight. tbl-\u003emask_array still points at old between the call_rcu() and the rcu_assign_pointer(), so a reader entering ovs_flow_tbl_lookup_stats() in that window picks up old in a fresh critical section that the pending grace period does not cover.  tbl_mask_array_realloc() runs in process context under ovs_mutex, so the window is preemptible and can outlast the grace period. Then mask_array_rcu_cb() frees old before the swap runs:    BUG: KASAN: slab-use-after-free in flow_lookup.constprop.0+0x2bf/0x2f0   Read of size 8 at addr ffff888020b3e018 by task poc/741    flow_lookup.constprop.0+0x2bf/0x2f0    ovs_flow_tbl_lookup_stats+0x4a3/0x5c0    ovs_dp_process_packet+0x19c/0x710    ovs_vport_receive+0x243/0x390    internal_dev_xmit+0x81/0x170   Freed by task 728:    kfree+0x16a/0x4e0    rcu_core+0x853/0x1030  Publish the new array before retiring the old one. The kfree_rcu() that call_rcu() replaced ran after the swap.",
  "id": "DEBIAN-CVE-2026-97611",
  "modified": "2026-09-26T04:47:35.945736537Z",
  "published": "2026-09-25T11:17:15.213Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-97611"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-97611"
  ]
}