Skip to main content

Linux Kernel EUVDEUVD-2026-86743

| CVE-2026-97612 HIGH
2026-09-25 Linux GHSA-gqv9-8gxf-xx6g
Linux Red Hat Suse Openvswitch
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local CAP_NET_ADMIN on OVS host
  2. Delivery
    Program MPLS push/pop/recirculate flow
  3. Exploit
    Re-push MPLS then trigger fragment
  4. Execution
    ovs_fragment uses stale negative offset
  5. Persist
    prepare_frag runs ~4GiB memcpy
  6. Impact
    Kernel page fault / DoS

Vulnerability Assessment

Exploitation Conditions

Requires local access with CAP_NET_ADMIN to program the kernel datapath, plus a host actively using Open vSwitch (or the tc act_mpls action) with MPLS push/pop actions AND a fragmentation action configured. The attacker must construct the specific sequence: push an MPLS label, pop every label, recirculate (ovs_flow_key_update leaves inner_* stale), then push MPLS again before ovs_fragment() runs. Limiting factors: it is not exploitable against a default kernel with no OVS/MPLS datapath configuration, it needs the CAP_NET_ADMIN privilege (no unauthenticated or remote path), and the outcome is a deterministic kernel crash rather than a controllable code-execution or data-leak primitive.
Impact

This is a Linux kernel local privilege/DoS-class flaw in the MPLS + Open vSwitch datapath. The NVD CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) correctly captures the LOCAL, authenticated nature (PR:L reflects the CAP_NET_ADMIN capability needed to program OVS/tc datapath actions), but the C:H/I:H/A:H triad is OVERSTATED: the described primitive is a fixed ~4GiB memcpy (RDX=(unsigned int)(-8)) from a 30-byte per-CPU buffer, which deterministically triggers a supervisor-mode page fault (KASAN Oops). That is a memory-corruption crash - denial of service - not a demonstrated confidentiality or controlled-integrity primitive; the length and source are not attacker-tunable, so C:H/I:H is not substantiated by the description. There is NO EPSS score, NO CISA KEV listing, and NO public exploit in the provided data, so this is no public exploit identified at time of analysis. Exploitation also depends on a non-default deployment (Open vSwitch or tc-act_mpls actively configured with MPLS push/pop plus fragmentation) and a specific action sequence (push→pop-all→recirculate→re-push), which further lowers real-world risk. Net: a real, patch-worthy kernel bug for OVS-heavy hosts, but a low-urgency, DoS-dominant issue rather than a high-priority RCE despite the 7.8 base score. The CWE is listed as N/A but the root cause is a stale header offset leading to an out-of-bounds write (CWE-787/CWE-823).
Exploit ScenarioDerived

A local user or container with CAP_NET_ADMIN on a host running Open vSwitch programs a datapath flow that pushes an MPLS label, pops all labels, recirculates, then re-pushes MPLS before a fragmentation action. Because skb_mpls_pop() left a stale inner_network_header offset, ovs_fragment() computes a negative (then huge unsigned) copy length and prepare_frag() performs a ~4GiB memcpy from a 30-byte per-CPU buffer, crashing the kernel. No public exploit or POC is identified in the provided data; the crash was reproduced by the reporter on v7.3-rc1.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

Linux kernel MPLS handling retains a stale inner_protocol/inner_network_header record after the last MPLS label is popped, so a subsequent MPLS push combined with Open vSwitch recirculation and fragmentation causes ovs_fragment() to trust a stale header offset and compute a wildly oversized memcpy that crashes the kernel. Affected are Linux builds exposing the MPLS datapath plus either Open vSwitch push/pop/fragment actions or the tc act_mpls action; exploitation requires local access with CAP_NET_ADMIN to program the datapath and a host already configured with those actions, and the observed outcome is a deterministic kernel BUG/page fault rather than a controllable code-execution or data-disclosure primitive, consistent with our assessed vector (AV:L/AC:H/PR:L, C:N/I:L/A:H). Vendor patches are available for the stable branches (6.12.111, 6.18.53, 7.2.7, 7.3-rc3), and no public exploit code has been identified at time of analysis; CVE-2026-97612 is not in CISA KEV.

RemediationAI

Vendor-released patch: 6.12.111, 6.18.53 and 7.2.7 on the stable branches, and 7.3-rc3 on the mainline release-candidate line (upstream commits 011e17b5cae19b9f6a150923275e41c278de64f0, da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e, b39120523475d6b436be7f6cb27d48064148a327, 78a86d75a70e1e227711c72865c59b1422d0a5ae, as listed at https://git.kernel.org/stable/c/011e17b5cae19b9f6a150923275e41c278de64f0); apply the distribution's backport rather than cherry-picking ad hoc, since the fix must land in both the MPLS helper and the sched callers (net/sched/act_mpls.c) to fully close the path. Until a reboot onto a patched kernel is possible, the effective compensating controls are configuration-based: remove or avoid OVS flows that combine MPLS push/pop actions with a fragment action, and avoid mixing tc act_mpls push/pop with fragmentation - this eliminates the exploitable sequence at the cost of disabling MPLS-over-fragmentation features on that datapath. Where OVS/MPLS is not required, unloading the openvswitch and act_mpls modules removes the attack surface entirely (trade-off: loss of those features). Because the flaw requires CAP_NET_ADMIN, tightening which local users, containers or namespaces hold that capability - dropping CAP_NET_ADMIN from untrusted workloads and restricting unprivileged user namespaces - blocks the trigger without affecting ordinary networking, and monitoring the kernel log for prepare_frag/ovs_fragment oopses and memcpy page faults at ffffe8ff addresses gives an early signal if the sequence is being attempted. Note that these are mitigations only; the deterministic crash (and the limited integrity exposure noted in our assessment) is fully resolved only by the patched kernel.

Affected VersionsENISA

Linux patch: 6.18.53
Linux 4.9
Linux 48d2ab609b6bbecb7698487c8579bc40de9d6dfa <011e17b5cae19b9f6a150923275e41c278de64f0
Linux patch: 7.3-rc3
Linux patch: 0
Linux patch: 7.2.7
Linux 48d2ab609b6bbecb7698487c8579bc40de9d6dfa <b39120523475d6b436be7f6cb27d48064148a327
Linux patch: 6.12.111
Linux 48d2ab609b6bbecb7698487c8579bc40de9d6dfa <78a86d75a70e1e227711c72865c59b1422d0a5ae
Linux 48d2ab609b6bbecb7698487c8579bc40de9d6dfa <da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The defect lives in the interplay between the MPLS helpers in the networking core and the Open vSwitch datapath classifier. skb_mpls_push() records the pre-encapsulation network header exactly once, guarded by !skb->inner_protocol, while skb_mpls_pop() never clears inner_protocol once the final label is removed, so the record outlives the encapsulation it describes. Open vSwitch can then push a label, pop every label, recirculate - ovs_flow_key_update() re-derives key->eth.type and resets network_header but leaves the inner_* fields untouched - and push MPLS again, at which point the second push is suppressed because inner_protocol is still populated and the stale inner_network_header still points at the older, deeper offset. ovs_fragment() then performs skb->network_header = skb->inner_network_header, driving skb_network_offset() negative; the guard in the fragment path is a signed comparison (if (skb_network_offset(skb) > MAX_L2_LEN)), which a negative value passes, and prepare_frag() widens the same value into an unsigned hlen that is used in memcpy(&data->l2_data, skb->data, hlen) - a ~4 GiB copy sourced from a roughly 30-byte per-CPU buffer (crash trace shows RDX = 0xfffffff8, i.e. (unsigned int)(-8) bytes) instead of the intended 8 bytes. The input data assigns no CWE; the underlying class is a stale-state / length-tracking defect where an offset invalidated logically by a pop is never cleared and is later widened by an unsigned conversion, the same shape previously fixed for IPv6 segment routing. Other skb_mpls_pop() callers are affected by the same root cause: net/sched/act_mpls.c receives the identical fix, and sch_frag.c needed matching save/restore handling of inner_protocol around fragmentation. Per the description, the flaw was reproduced on 7.3-rc1 and is fixed upstream in 7.3-rc3 plus the stable backports referenced in the advisory.

Know when Openvswitch gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 5.3 MEDIUM

Local CAP_NET_ADMIN (PR:L) and a specific OVS-MPLS recirculation sequence on a non-default datapath (AC:H); impact is a crash/OOB-write (A:H, minor I:L), no disclosure (C:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 25, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Sep 25, 2026 - 11:02 EUVD
CVE Published
Sep 25, 2026 - 10:22 cve.org
HIGH 7.8
CVE Published
Sep 25, 2026 - 10:22 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: mpls: clear inner_protocol when the last label is popped

skb_mpls_push() records the pre-encapsulation network header once, gated on !skb->inner_protocol. skb_mpls_pop() never clears that record, so it outlives the encapsulation it describes.

Open vSwitch can then re-push MPLS onto a packet whose inner_network_header still points at the older, deeper offset: push a label, pop every label, recirculate (ovs_flow_key_update() re-derives key->eth.type and resets network_header, but leaves inner_*), then push again. ovs_fragment() trusts the record:

skb->network_header = skb->inner_network_header;

so skb_network_offset() goes negative. The bound check is signed:

if (skb_network_offset(skb) > MAX_L2_LEN)

a negative offset passes it, and prepare_frag() widens the value:

unsigned int hlen = skb_network_offset(skb); memcpy(&data->l2_data, skb->data, hlen);

which is a ~4GiB memcpy out of a 30-byte per-CPU buffer.

Reproduced on v7.3-rc1. RDX is the truncated length, (unsigned int)(-8):

BUG: unable to handle page fault for address: ffffe8ffffc16000 #PF: supervisor write access in kernel mode Oops: 0002 [#1] SMP KASAN NOPTI RIP: 0010:memcpy+0x8/0x20 RDX: 00000000fffffff8 RSI: ffff888105d732db RDI: ffffe8ffffc16000 prepare_frag+0x3df/0x4e0 ovs_fragment+0x589/0x7e0 do_output+0x4ce/0x5e0 do_execute_actions+0x55d2/0x7b30 ovs_execute_actions+0xea/0x450

Same root-cause shape as commit 975b5b067f52 ("ipv6: sr: restore network header before routing and forwarding"): a stale network header offset reaching a consumer that widens it. Here it originates in the MPLS push/pop path.

Clear inner_protocol once the packet is no longer MPLS, so a later push re-records the current header. net/sched/act_mpls.c is the only other skb_mpls_pop() caller and gets the same fix; sch_frag.c saves and restores inner_protocol around fragmentation in the same way OVS does.

Executive ViewAI

Why It Matters

Linux kernel builds that enable the MPLS datapath together with Open vSwitch or tc MPLS actions can be crashed by a local user holding CAP_NET_ADMIN, resulting in a deterministic kernel panic and denial of service rather than code execution or data disclosure. The exposure is concentrated in network-virtualization and MPLS-heavy environments; standard Linux hosts without those features are not affected. Leadership should note that vendor patches are already available and no public exploit code has been identified at time of analysis, making remediation a straightforward kernel-version management task.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
High
Linux kernel is ubiquitous, but the vulnerable Open vSwitch/act_mpls datapath path is a common-not-universal subset
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

More in Openvswitch

View all
CVE-2018-17205 HIGH POC
7.5 Sep 19

An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto_rule_insert__ in ofproto/ofproto.c.
CVE-2016-2074 CRITICAL
9.8 Jul 03

Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows
CVE-2017-9214 CRITICAL
9.8 May 23

In Open vSwitch (OvS) 2.7.0, while parsing an OFPT_QUEUE_GET_CONFIG_REPLY type OFP 1.0 message, there is a buffer over-r
CVE-2017-9265 CRITICAL
9.8 May 29

In Open vSwitch (OvS) v2.7.0, there is a buffer over-read while parsing the group mod OpenFlow message sent from the con
CVE-2017-9264 CRITICAL
9.8 May 29

In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a buffer over-read while parsing
CVE-2016-10377 HIGH
8.8 May 29

In Open vSwitch (OvS) 2.5.0, a malformed IP packet can cause the switch to read past the end of the packet buffer due to
CVE-2026-97611 HIGH
7.8 Sep 25

Use-after-free in the Linux kernel's in-kernel Open vSwitch datapath lets a local user holding CAP_NET_ADMIN crash the k
CVE-2024-22563 HIGH
7.5 Jan 19

openvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in openvswitch-2.17.8/lib/util.c.

CVE-2017-9263 MEDIUM
6.5 May 29

In Open vSwitch (OvS) 2.7.0, while parsing an OpenFlow role status message, there is a call to the abort() function for

CVE-2022-0669 MEDIUM
6.5 Aug 29

A flaw was found in dpdk. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. This Uncontroll
CVE-2017-14970 MEDIUM
5.9 Oct 02

In lib/ofp-util.c in Open vSwitch (OvS) before 2.8.1, there are multiple memory leaks while parsing malformed OpenFlow g
CVE-2023-5366 MEDIUM
5.5 Oct 06

A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass Op

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-97612 REF https://git.kernel.org/stable/c/011e17b5cae19b9f6a150923275e41c278de64f0 REF https://git.kernel.org/stable/c/0b3425fd0ecd515997956f7bb8a8a576b444ed64 REF https://git.kernel.org/stable/c/38db09804b2616aa1e2fcdf97f0c3ae8b9dbdd34 REF https://git.kernel.org/stable/c/55ed97db27bffe29c21fdefd5d25601322c36ff8 REF https://git.kernel.org/stable/c/78a86d75a70e1e227711c72865c59b1422d0a5ae REF https://git.kernel.org/stable/c/833ec2788322306407503b4cfc7745cd1f9d785f REF https://git.kernel.org/stable/c/b39120523475d6b436be7f6cb27d48064148a327 REF https://git.kernel.org/stable/c/da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy