Description
An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutron port with the direct vnic_type, creating an instance bound to that port, and then changing the vnic_type of the bound port to macvtap, an authenticated user may cause the compute service to fail to restart, resulting in a possible denial of service. Only Nova deployments configured with SR-IOV are affected.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nova | 2:26.0.0~rc1-3 | — |
| Debian 13 | nova | 2:26.0.0~rc1-3 | — |
| Debian 12 | nova | 2:26.0.0~rc1-3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | nova | 3:25.1.0-0ubuntu1 | — |
| Ubuntu 20.04 LTS | nova | 2:21.2.4-0ubuntu2.2 | USN-5866-1 |
| Ubuntu 18.04 LTS | nova | 2:17.0.13-0ubuntu5.3 | USN-5866-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | nova | 2:13.1.4-0ubuntu4.5+esm1 | USN-5866-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 16 | openstack-nova | 1:20.6.2-2.20230308185148.fc01371.el8ost | RHSA-2023:1948 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | nova | < 23.2.2 | 23.2.2 | GHSA-v725-c588-h936 |
| PyPI | nova | >= 24.0.0, < 24.1.2 | 24.1.2 | GHSA-v725-c588-h936 |
| PyPI | nova | >= 25.0.0, < 25.0.2 | 25.0.2 | GHSA-v725-c588-h936 |
| PyPI | nova | < 23.2.2 · >= 24.0.0, < 24.1.2 · >= 25.0.0, < 25.0.2 | 23.2.2, 24.1.2, 25.0.2 | PYSEC-2026-882 |
Advisories 3
- RHSA-2023:1948 Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (openstack-nova) security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- USN-5866-1 nova vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- WID-SEC-2022-1008 Red Hat OpenStack: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Apr 26, 2023