CVE-2026-64531

CVE-2026-64531 is a structural integrity failure in Open vSwitch, not a classic buffer overflow. The vulnerability stems from commit a1e64addf3ff, which removed a guard labeled as 'misbehaving actions length check' to allow flows larger than 64 KiB. That guard was doing two jobs simultaneously: enforcing a size limit and preserving the internal consistency of nested nlattr streams. Removing it broke the second job entirely. The mechanism is subtle but deterministic. The nla_len field truncates to u16, so when a CLONE/CT action exceeds that limit, the length field is silently truncated rather than rejected. The kernel continues processing without crashing—the corruption manifests later during traversal, when the parser reenters the attribute stream at an attacker-controlled offset. Because the CLONE/CT payload originates from userspace and survives multiple translation boundaries (netlink to datapath actions to kernel offload), the attacker doesn't guess what lands at the misaligned offset; they explicitly chose it. This is a controlled content injection primitive, not a parsing accident. The fix's complexity is diagnostic. The reverse construction order cleanup, per-action-type unwinding, and recursive builder handling exist because the action builder API has no unified resource ownership model. When validation fails mid-construction, the only path forward is manual layer-by-layer rollback. This architectural smell predicts future bugs—specifically resource leaks or use-after-free in SAMPLE/CLONE paths where ownership gets misattributed during error handling. The blast radius extends beyond OVS. Downstream consumers including tc, netfilter, and hardware offload paths receive the malformed flow representation and treat it as structurally valid. If OVS flows are offloaded to hardware, the attacker-controlled action structure may persist in the hardware data plane. The temporal dimension matters: the vulnerability didn't exist at commit time. It emerged as production flows grew past 64 KiB, meaning years may have passed with silent structural corruption in deployed systems. The 'misbehaving' label on the original guard is itself a warning—future maintainers will see the cleanup code as unnecessary complexity and may remove it, restarting the entropy cycle. Audit other nlattr consumers that handle nested serialization from userspace. Where size checks serve dual purposes (buffer bounds AND structural invariants), the same failure mode likely exists.

Reviewed through automated stages and approved by a human before publication.