# openvswitch: fix soft lockup in the netlink flow dump

CVE record · `CVE-2026-99025`

- **Identifiers:** `CVE-2026-99025`
- **State:** Confirmed
- **Severity:** No CVSS score
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 23 Oct 2026
- **Updated:** 30 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 23 Oct 2026, 12:21 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `63e7959c4b9bd6f791061c460a22d9ee32ae2240 to before ef77dd59cb7b7b0ac0bedd3fe9ee7a8acd8a58f2` (git)
  - affected: `63e7959c4b9bd6f791061c460a22d9ee32ae2240 to before 9ffb9897b39037a688ae01d0b3aea4ccce27dd75` (git)
  - affected: `63e7959c4b9bd6f791061c460a22d9ee32ae2240 to before 5b6a8bbdcdd7d0fddee466c1c7fe5b7f30aa392c` (git)
  - affected: `63e7959c4b9bd6f791061c460a22d9ee32ae2240 to before c995c52eba1926a5e82823fa5573a6f1b1010e5d` (git)
  - affected: `63e7959c4b9bd6f791061c460a22d9ee32ae2240 to before b872de585edff534056c65ba30970b68499fca14` (git)
  - affected: `63e7959c4b9bd6f791061c460a22d9ee32ae2240 to before 55f12552b00a34ca7ab5cf2d2b5ed02f8f06a965` (git)
  - affected: `63e7959c4b9bd6f791061c460a22d9ee32ae2240 to before 80db24f3c16fdeef85460d9d66a4aae7a9cb92b4` (git)
  - affected: `63e7959c4b9bd6f791061c460a22d9ee32ae2240 to before aaaaf87ea99b8766c9a8aa0e71aa42e6bc8a5320` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `3.16`
  - unaffected: `before 3.16` (semver)
  - unaffected: `5.10.273 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.224 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.191 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.160 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.113 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.57 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.11 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

No source has published a CVSS score for this record yet.

- **CISA KEV:** Not listed.
- **EPSS:** 0.0018, the 7th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 23 Oct 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-99025](https://www.cve.org/CVERecord?id=CVE-2026-99025)
- [NVD: CVE-2026-99025](https://nvd.nist.gov/vuln/detail/CVE-2026-99025)

### References from the CNA

- <https://git.kernel.org/stable/c/ef77dd59cb7b7b0ac0bedd3fe9ee7a8acd8a58f2>
- <https://git.kernel.org/stable/c/9ffb9897b39037a688ae01d0b3aea4ccce27dd75>
- <https://git.kernel.org/stable/c/5b6a8bbdcdd7d0fddee466c1c7fe5b7f30aa392c>
- <https://git.kernel.org/stable/c/c995c52eba1926a5e82823fa5573a6f1b1010e5d>
- <https://git.kernel.org/stable/c/b872de585edff534056c65ba30970b68499fca14>
- <https://git.kernel.org/stable/c/55f12552b00a34ca7ab5cf2d2b5ed02f8f06a965>
- <https://git.kernel.org/stable/c/80db24f3c16fdeef85460d9d66a4aae7a9cb92b4>
- <https://git.kernel.org/stable/c/aaaaf87ea99b8766c9a8aa0e71aa42e6bc8a5320>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-99025>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-99025/>. Everything for agents: <https://agentprime.io/llms.txt>.