Description
A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | openvswitch | — | 3.1.0 |
| Red Hat | Fast Datapath for RHEL 7 | — | — |
| Red Hat | Fast Datapath for RHEL 8 | — | — |
| Red Hat | Fast Datapath for RHEL 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 3.11 | — | — |
| RDO | OpenStack RDO | — | — |
| Fedora | Fedora | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openvswitch | 3.3.0-1 | — |
| Debian 13 | openvswitch | 3.3.0-1 | — |
| Debian 12 | openvswitch | 3.1.0-2+deb12u1 | DSA-5640-1 |
| Debian 11 | openvswitch | 2.15.0+ds1-2+deb11u5 | DSA-5640-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | openvswitch | 2.17.9-0ubuntu0.22.04.1 | USN-6690-1 |
| Ubuntu 20.04 LTS | openvswitch | 2.13.8-0ubuntu1.4 | USN-6690-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | openvswitch3.1 +4 | 3.1.0-88.el9fdp | RHSA-2024:1227 |
| RHEL 8 | openvswitch2.17 +5 | 2.17.0-148.el8fdp | RHSA-2024:1234 |
| RHEL 8 | openvswitch3.1 +5 | 3.1.0-96.el8fdp | RHSA-2024:1235 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | openvswitch | 3.1.7-150600.33.9.1 | SUSE-SU-2026:0280-1 |
| SLES 15 SP5 | openvswitch | 2.14.2-150400.24.23.1 | SUSE-SU-2024:0937-1 |
| SLES 15 SP5 | openvswitch3 | 3.1.0-150500.3.16.1 | SUSE-SU-2026:0290-1, SUSE-SU-2024:0738-1 |
| SLES 15 SP4 | openvswitch | 2.14.2-150400.24.23.1 | SUSE-SU-2024:0937-1 |
| SLES 15 SP3 | openvswitch | 2.14.2-150300.19.20.1 | SUSE-SU-2024:0922-1 |
| SLES 15 SP2 | openvswitch | 2.13.2-150200.9.34.1 | SUSE-SU-2024:0912-1 |
Show 15 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP6 | openvswitch | 3.1.7-150600.33.9.1 | SUSE-SU-2026:0280-1 |
| SLES for SAP 15 SP5 | openvswitch3 | 3.1.7-150500.3.25.1 | SUSE-SU-2026:0290-1 |
| SLES for SAP 15 SP4 | openvswitch | 2.14.2-150400.24.23.1 | SUSE-SU-2024:0937-1 |
| SLES for SAP 15 SP3 | openvswitch | 2.14.2-150300.19.20.1 | SUSE-SU-2024:0922-1 |
| SLES for SAP 15 SP2 | openvswitch | 2.13.2-150200.9.34.1 | SUSE-SU-2024:0912-1 |
| SLE Micro 6.1 | openvswitch | 3.1.7-slfo.1.1_2.1 | SUSE-SU-2026:20061-1 |
| SLE Micro 6.0 | openvswitch | 3.1.7-4.1 | SUSE-SU-2026:20049-1 |
| SLE Micro 5.5 | openvswitch3 | 3.1.0-150500.3.16.1 | SUSE-SU-2026:0290-1, SUSE-SU-2024:0738-2, SUSE-SU-2024:0738-1 |
| SLE HPC 15 SP5 | openvswitch3 | 3.1.7-150500.3.25.1 | SUSE-SU-2026:0290-1 |
| SLE HPC 15 SP4 | openvswitch | 2.14.2-150400.24.23.1 | SUSE-SU-2024:0937-1 |
| SLE HPC 15 SP3 | openvswitch | 2.14.2-150300.19.20.1 | SUSE-SU-2024:0922-1 |
| SLE HPC 15 SP2 | openvswitch | 2.13.2-150200.9.34.1 | SUSE-SU-2024:0912-1 |
| SUSE Manager Server 4.3 | openvswitch | 2.14.2-150400.24.23.1 | SUSE-SU-2024:0937-1 |
| SUSE Manager Proxy 4.3 | openvswitch | 2.14.2-150400.24.23.1 | SUSE-SU-2024:0937-1 |
| SUSE Enterprise Storage 7.1 | openvswitch | 2.14.2-150300.19.20.1 | SUSE-SU-2024:0922-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openvswitch | 3.1.0-19.1 | openSUSE-SU-2024:13725-1 |
| openSUSE Leap 15.6 | openvswitch | 3.1.7-150600.33.9.1 | SUSE-SU-2026:0280-1 |
| openSUSE Leap 15.6 | openvswitch3 | 3.1.7-150500.3.25.1 | SUSE-SU-2026:0290-1 |
| openSUSE Leap 15.5 | openvswitch | 2.14.2-150400.24.23.1 | SUSE-SU-2024:0937-1 |
| openSUSE Leap 15.5 | openvswitch3 | 3.1.0-150500.3.16.1 | SUSE-SU-2024:0738-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | openvswitch | 2.17.9-r0 | — |
| Alpine v3.23 | openvswitch | 2.17.9-r0 | — |
| Alpine v3.22 | openvswitch | 2.17.9-r0 | — |
| Alpine v3.21 | openvswitch | 2.17.9-r0 | — |
| Alpine v3.20 | openvswitch | 2.17.9-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | openvswitch | 2.17.9-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | openvswitch | 3.3.0-1 | — |
Advisories 16
- RHSA-2024:1235 Red Hat Security Advisory: openvswitch3.1 security update Red Hat Security Advisories (RHSA) · Sep 20, 2026
- RHSA-2024:1227 Red Hat Security Advisory: openvswitch3.1 security update Red Hat Security Advisories (RHSA) · Sep 20, 2026
- RHSA-2024:1234 Red Hat Security Advisory: openvswitch2.17 security update Red Hat Security Advisories (RHSA) · Sep 20, 2026
- USN-6690-1 openvswitch vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- SUSE-SU-2026:20061-1 Security update for openvswitch SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20049-1 Security update for openvswitch SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0290-1 Security update for openvswitch3 SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0280-1 Security update for openvswitch SUSE / openSUSE Security Updates · Mar 23, 2026
- DSA-5640-1 openvswitch - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2024:0738-2 Security update for openvswitch3 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0912-1 Security update for openvswitch SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0738-1 Security update for openvswitch3 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0922-1 Security update for openvswitch SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13725-1 libopenvswitch-3_1-0-3.1.0-19.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-0580 Red Hat Enterprise Linux (openvswitch): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jan 26, 2026
- SUSE-SU-2024:0937-1 Security update for openvswitch SUSE / openSUSE Security Updates · May 2, 2025
References
- https://access.redhat.com/security/cve/CVE-2023-3966 vdb-entry
- RHBZ#2178363 issue-tracking
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VYYUBF6OW2JG7VOFEOROHXGSJCTES3QO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFZADABUDOFI2KZIRQBYFZCIKH55RGY3/