Linux Kernel EUVD-2026-55504

Open vSwitch is a multilayer software switch shipped as the in-kernel 'openvswitch' datapath module and widely used for SDN/virtual networking (OpenStack Neutron, OVN, container CNIs). The OVS_ACTION_ATTR_TRUNC action tells the datapath to truncate a packet before further processing; the kernel records this as a delta from the original skb length in OVS_CB(skb)->cutlen rather than as an absolute preserved length. When a subsequent userspace action must segment a GSO (Generic Segmentation Offload) super-packet, queue_gso_packets() propagates that same delta to each smaller segment; because the delta was computed against the large original frame, it can exceed a small segment's skb->len. queue_userspace_packet() then subtracts cutlen from skb->len and hands the underflowed (wrapped) value to skb_zerocopy(), producing an out-of-bounds read when the packet is zero-copied into the netlink upcall to ovs-vswitchd. No CWE was assigned by NVD, but the root cause is an integer/length underflow (CWE-191 class) leading to an out-of-bounds read (CWE-125). The fix stores the maximum preserved length and bounds every consumer against the current skb->len, using U32_MAX as a no-truncation sentinel so the value stays valid if skb geometry changes.