CVE-2026-97611: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-p256-hqvm-38xq
Share
CVSS 7.8
Published
Advisory Summary

CVE-2026-97611 is a HIGH (CVSS 7.8) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-97611 at a Glance

CVE Identifier CVE-2026-97611
GHSA Identifier GHSA-p256-hqvm-38xq
Severity HIGH
CVSS v3.1 Base Score 7.8
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-97611

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-97611, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix use-after-free of the flow table mask array tbl_mask_array_realloc() retires the old mask_array before it stops being reachable: old = ovsl_dereference(tbl->mask_array); if (old) { ... call_rcu(&old->rcu, mask_array_rcu_cb); } rcu_assign_pointer(tbl->mask_array, new); call_rcu() only waits for read-side critical sections already in flight. tbl->mask_array still points at old between the call_rcu() and the rcu_assign_pointer(), so a reader entering ovs_flow_tbl_lookup_stats() in that window picks up old in a fresh critical section that the pending grace period does not cover. tbl_mask_array_realloc() runs in process context under ovs_mutex, so the window is preemptible and can outlast the grace period. Then mask_array_rcu_cb() frees old before the swap runs: BUG: KASAN: slab-use-after-free in flow_lookup.constprop.0+0x2bf/0x2f0 Read of size 8 at addr ffff888020b3e018 by task poc/741 flow_lookup.constprop.0+0x2bf/0x2f0 ovs_flow_tbl_lookup_stats+0x4a3/0x5c0 ovs_dp_process_packet+0x19c/0x710 ovs_vport_receive+0x243/0x390 internal_dev_xmit+0x81/0x170 Freed by task 728: kfree+0x16a/0x4e0 rcu_core+0x853/0x1030 Publish the new array before retiring the old one. The kfree_rcu() that call_rcu() replaced ran after the swap.

References

NVD — CVE-2026-97611 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-97611
git.kernel.org/stable/c/017dbbf0d6... WEB
https://git.kernel.org/stable/c/017dbbf0d6c319a487f68e22f56d91fc787d5525
git.kernel.org/stable/c/035e9c3722... WEB
https://git.kernel.org/stable/c/035e9c3722067648a99010711d0ce81f42572ef4
git.kernel.org/stable/c/4016ead17a... WEB
https://git.kernel.org/stable/c/4016ead17acd75312c066ecd47c4b7f0a81ceaa2
git.kernel.org/stable/c/4c98b492e9... WEB
https://git.kernel.org/stable/c/4c98b492e9ed63f9ca3e23566d9a6a4f235944f4
git.kernel.org/stable/c/76678217cd... WEB
https://git.kernel.org/stable/c/76678217cdabc41e3c74c23b45b62086ffb8fe7a
git.kernel.org/stable/c/a0d18d21d4... WEB
https://git.kernel.org/stable/c/a0d18d21d48a551f82ee344e50efb8a682161489
git.kernel.org/stable/c/ba4ba11ed6... WEB
https://git.kernel.org/stable/c/ba4ba11ed6eb8972c69070417fc27b48deb002e8
git.kernel.org/stable/c/cd982e1168... WEB
https://git.kernel.org/stable/c/cd982e11684def5d4a9fcfd5354de09032828414

Frequently Asked Questions

What is CVE-2026-97611?
CVE-2026-97611 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-97611?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-97611?
CVE-2026-97611 has a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-97611?
CVE-2026-97611 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-97611?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-p256-hqvm-38xq",
  "modified" : "2026-10-03T12:31:19Z",
  "published" : "2026-09-25T12:31:26Z",
  "aliases" : [ "CVE-2026-97611" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix use-after-free of the flow table mask array\n\ntbl_mask_array_realloc() retires the old mask_array before it stops being\nreachable:\n\n\told = ovsl_dereference(tbl->mask_array);\n\tif (old) {\n\t\t...\n\t\tcall_rcu(&old->rcu, mask_array_rcu_cb);\n\t}\n\n\trcu_assign_pointer(tbl->mask_array, new);\n\ncall_rcu() only waits for read-side critical sections already in flight.\ntbl->mask_array still points at old between the call_rcu() and the\nrcu_assign_pointer(), so a reader entering ovs_flow_tbl_lookup_stats() in\nthat window picks up old in a fresh critical section that the pending\ngrace period does not cover.\n\ntbl_mask_array_realloc() runs in process context under ovs_mutex, so the\nwindow is preemptible and can outlast the grace period. Then\nmask_array_rcu_cb() frees old before the swap runs:\n\n  BUG: KASAN: slab-use-after-free in flow_lookup.constprop.0+0x2bf/0x2f0\n  Read of size 8 at addr ffff888020b3e018 by task poc/741\n   flow_lookup.constprop.0+0x2bf/0x2f0\n   ovs_flow_tbl_lookup_stats+0x4a3/0x5c0\n   ovs_dp_process_packet+0x19c/0x710\n   ovs_vport_receive+0x243/0x390\n   internal_dev_xmit+0x81/0x170\n  Freed by task 728:\n   kfree+0x16a/0x4e0\n   rcu_core+0x853/0x1030\n\nPublish the new array before retiring the old one. The kfree_rcu() that\ncall_rcu() replaced ran after the swap.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-97611"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/017dbbf0d6c319a487f68e22f56d91fc787d5525"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/035e9c3722067648a99010711d0ce81f42572ef4"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4016ead17acd75312c066ecd47c4b7f0a81ceaa2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4c98b492e9ed63f9ca3e23566d9a6a4f235944f4"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/76678217cdabc41e3c74c23b45b62086ffb8fe7a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a0d18d21d48a551f82ee344e50efb8a682161489"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ba4ba11ed6eb8972c69070417fc27b48deb002e8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/cd982e11684def5d4a9fcfd5354de09032828414"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-25T11:17:15Z"
  }
}