{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-97612", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.158Z", "datePublished": "2026-09-25T10:22:21.423Z", "dateUpdated": "2026-10-19T09:10:16.030Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:10:16.030Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mpls: clear inner_protocol when the last label is popped\n\nskb_mpls_push() records the pre-encapsulation network header once, gated\non !skb->inner_protocol. skb_mpls_pop() never clears that record, so it\noutlives the encapsulation it describes.\n\nOpen vSwitch can then re-push MPLS onto a packet whose\ninner_network_header still points at the older, deeper offset: push a\nlabel, pop every label, recirculate (ovs_flow_key_update() re-derives\nkey->eth.type and resets network_header, but leaves inner_*), then push\nagain. ovs_fragment() trusts the record:\n\n\tskb->network_header = skb->inner_network_header;\n\nso skb_network_offset() goes negative. The bound check is signed:\n\n\tif (skb_network_offset(skb) > MAX_L2_LEN)\n\na negative offset passes it, and prepare_frag() widens the value:\n\n\tunsigned int hlen = skb_network_offset(skb);\n\tmemcpy(&data->l2_data, skb->data, hlen);\n\nwhich is a ~4GiB memcpy out of a 30-byte per-CPU buffer.\n\nReproduced on v7.3-rc1. RDX is the truncated length, (unsigned int)(-8):\n\n BUG: unable to handle page fault for address: ffffe8ffffc16000\n #PF: supervisor write access in kernel mode\n Oops: 0002 [#1] SMP KASAN NOPTI\n RIP: 0010:memcpy+0x8/0x20\n RDX: 00000000fffffff8 RSI: ffff888105d732db RDI: ffffe8ffffc16000\n prepare_frag+0x3df/0x4e0\n ovs_fragment+0x589/0x7e0\n do_output+0x4ce/0x5e0\n do_execute_actions+0x55d2/0x7b30\n ovs_execute_actions+0xea/0x450\n\nSame root-cause shape as commit 975b5b067f52 (\"ipv6: sr: restore network\nheader before routing and forwarding\"): a stale network header offset\nreaching a consumer that widens it. Here it originates in the MPLS\npush/pop path.\n\nClear inner_protocol once the packet is no longer MPLS, so a later push\nre-records the current header. net/sched/act_mpls.c is the only other\nskb_mpls_pop() caller and gets the same fix; sch_frag.c saves and\nrestores inner_protocol around fragmentation in the same way OVS does." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The stale inner_network_header comes from OVS flow actions (push_mpls, pop_mpls, recirc, push_mpls) that the attacker installs over the ovs_flow/ovs_packet generic netlink families. No field of a received packet causes the bad offset, so the vector is local netlink rather than the wire.\nAC:L - The attacker chooses the flow action sequence and the oversized packet that sends do_output into ovs_fragment(). skb_mpls_pop() then deterministically leaves inner_protocol set, and the negative offset always passes the signed MAX_L2_LEN check, so nothing depends on timing or outside state.\nPR:L - The OVS datapath, vport, flow and packet genl operations use GENL_UNS_ADMIN_PERM with netnsok=true. That means CAP_NET_ADMIN inside an unprivileged user and network namespace (unshare -Urn) is enough to create a datapath, install the flows and execute packets.\nUI:N - No victim action is needed. The attacker installs the flows and injects or sends the packet themselves inside their own namespace.\nS:U - The overflow corrupts memory of the same kernel that performs the check. This is ordinary in-kernel memory corruption and crosses no hypervisor or IOMMU boundary.\nC:H - prepare_frag() turns a negative skb_network_offset() into an unsigned hlen of about 4 GiB and memcpy()s attacker packet bytes past the 30-byte per-CPU ovs_frag_data.l2_data. The write covers exec_level, owner, bh_lock and the per-CPU data that follows, and memory corruption of this kind can be leveraged for information disclosure.\nI:H - This is an out-of-bounds write of attacker-controlled skb data into the per-CPU ovs_pcpu_storage and the per-CPU memory after it, including a task_struct pointer (owner) and lock state. The corruption stays in place if the oops happens in process context (OVS_PACKET_CMD_EXECUTE).\nA:H - The runaway memcpy in prepare_frag() always runs until it hits an unmapped per-CPU page and oopses, as the fix's reproducer shows (write fault in memcpy from prepare_frag/ovs_fragment). The attacker can repeat this at will." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/core/skbuff.c" ], "versions": [ { "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "lessThan": "55ed97db27bffe29c21fdefd5d25601322c36ff8", "status": "affected", "versionType": "git" }, { "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "lessThan": "833ec2788322306407503b4cfc7745cd1f9d785f", "status": "affected", "versionType": "git" }, { "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "lessThan": "38db09804b2616aa1e2fcdf97f0c3ae8b9dbdd34", "status": "affected", "versionType": "git" }, { "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "lessThan": "0b3425fd0ecd515997956f7bb8a8a576b444ed64", "status": "affected", "versionType": "git" }, { "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "lessThan": "011e17b5cae19b9f6a150923275e41c278de64f0", "status": "affected", "versionType": "git" }, { "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "lessThan": "da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e", "status": "affected", "versionType": "git" }, { "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "lessThan": "b39120523475d6b436be7f6cb27d48064148a327", "status": "affected", "versionType": "git" }, { "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "lessThan": "78a86d75a70e1e227711c72865c59b1422d0a5ae", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/core/skbuff.c" ], "versions": [ { "version": "4.9", "status": "affected" }, { "version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.10.271" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.15.222" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.1.189" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.6.158" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.12.111" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.18.53" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.2.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/55ed97db27bffe29c21fdefd5d25601322c36ff8" }, { "url": "https://git.kernel.org/stable/c/833ec2788322306407503b4cfc7745cd1f9d785f" }, { "url": "https://git.kernel.org/stable/c/38db09804b2616aa1e2fcdf97f0c3ae8b9dbdd34" }, { "url": "https://git.kernel.org/stable/c/0b3425fd0ecd515997956f7bb8a8a576b444ed64" }, { "url": "https://git.kernel.org/stable/c/011e17b5cae19b9f6a150923275e41c278de64f0" }, { "url": "https://git.kernel.org/stable/c/da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e" }, { "url": "https://git.kernel.org/stable/c/b39120523475d6b436be7f6cb27d48064148a327" }, { "url": "https://git.kernel.org/stable/c/78a86d75a70e1e227711c72865c59b1422d0a5ae" } ], "title": "net: mpls: clear inner_protocol when the last label is popped", "x_generator": { "engine": "bippy-1.2.0" } } } }