FKIE_CVE-2026-97612

Vulnerability from fkie_nvd - Published: 2026-09-25 11:17 - Updated: 2026-09-25 15:18
Summary
In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear inner_protocol when the last label is popped skb_mpls_push() records the pre-encapsulation network header once, gated on !skb->inner_protocol. skb_mpls_pop() never clears that record, so it outlives the encapsulation it describes. Open vSwitch can then re-push MPLS onto a packet whose inner_network_header still points at the older, deeper offset: push a label, pop every label, recirculate (ovs_flow_key_update() re-derives key->eth.type and resets network_header, but leaves inner_*), then push again. ovs_fragment() trusts the record: skb->network_header = skb->inner_network_header; so skb_network_offset() goes negative. The bound check is signed: if (skb_network_offset(skb) > MAX_L2_LEN) a negative offset passes it, and prepare_frag() widens the value: unsigned int hlen = skb_network_offset(skb); memcpy(&data->l2_data, skb->data, hlen); which is a ~4GiB memcpy out of a 30-byte per-CPU buffer. Reproduced on v7.3-rc1. RDX is the truncated length, (unsigned int)(-8): BUG: unable to handle page fault for address: ffffe8ffffc16000 #PF: supervisor write access in kernel mode Oops: 0002 [#1] SMP KASAN NOPTI RIP: 0010:memcpy+0x8/0x20 RDX: 00000000fffffff8 RSI: ffff888105d732db RDI: ffffe8ffffc16000 prepare_frag+0x3df/0x4e0 ovs_fragment+0x589/0x7e0 do_output+0x4ce/0x5e0 do_execute_actions+0x55d2/0x7b30 ovs_execute_actions+0xea/0x450 Same root-cause shape as commit 975b5b067f52 ("ipv6: sr: restore network header before routing and forwarding"): a stale network header offset reaching a consumer that widens it. Here it originates in the MPLS push/pop path. Clear inner_protocol once the packet is no longer MPLS, so a later push re-records the current header. net/sched/act_mpls.c is the only other skb_mpls_pop() caller and gets the same fix; sch_frag.c saves and restores inner_protocol around fragmentation in the same way OVS does.
Impacted products
Vendor Product Version

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "011e17b5cae19b9f6a150923275e41c278de64f0",
              "status": "affected",
              "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa",
              "versionType": "git"
            },
            {
              "lessThan": "da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e",
              "status": "affected",
              "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa",
              "versionType": "git"
            },
            {
              "lessThan": "b39120523475d6b436be7f6cb27d48064148a327",
              "status": "affected",
              "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa",
              "versionType": "git"
            },
            {
              "lessThan": "78a86d75a70e1e227711c72865c59b1422d0a5ae",
              "status": "affected",
              "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mpls: clear inner_protocol when the last label is popped\n\nskb_mpls_push() records the pre-encapsulation network header once, gated\non !skb-\u003einner_protocol. skb_mpls_pop() never clears that record, so it\noutlives the encapsulation it describes.\n\nOpen vSwitch can then re-push MPLS onto a packet whose\ninner_network_header still points at the older, deeper offset: push a\nlabel, pop every label, recirculate (ovs_flow_key_update() re-derives\nkey-\u003eeth.type and resets network_header, but leaves inner_*), then push\nagain. ovs_fragment() trusts the record:\n\n\tskb-\u003enetwork_header = skb-\u003einner_network_header;\n\nso skb_network_offset() goes negative. The bound check is signed:\n\n\tif (skb_network_offset(skb) \u003e MAX_L2_LEN)\n\na negative offset passes it, and prepare_frag() widens the value:\n\n\tunsigned int hlen = skb_network_offset(skb);\n\tmemcpy(\u0026data-\u003el2_data, skb-\u003edata, hlen);\n\nwhich is a ~4GiB memcpy out of a 30-byte per-CPU buffer.\n\nReproduced on v7.3-rc1. RDX is the truncated length, (unsigned int)(-8):\n\n  BUG: unable to handle page fault for address: ffffe8ffffc16000\n  #PF: supervisor write access in kernel mode\n  Oops: 0002 [#1] SMP KASAN NOPTI\n  RIP: 0010:memcpy+0x8/0x20\n  RDX: 00000000fffffff8 RSI: ffff888105d732db RDI: ffffe8ffffc16000\n   prepare_frag+0x3df/0x4e0\n   ovs_fragment+0x589/0x7e0\n   do_output+0x4ce/0x5e0\n   do_execute_actions+0x55d2/0x7b30\n   ovs_execute_actions+0xea/0x450\n\nSame root-cause shape as commit 975b5b067f52 (\"ipv6: sr: restore network\nheader before routing and forwarding\"): a stale network header offset\nreaching a consumer that widens it. Here it originates in the MPLS\npush/pop path.\n\nClear inner_protocol once the packet is no longer MPLS, so a later push\nre-records the current header. net/sched/act_mpls.c is the only other\nskb_mpls_pop() caller and gets the same fix; sch_frag.c saves and\nrestores inner_protocol around fragmentation in the same way OVS does."
    }
  ],
  "id": "CVE-2026-97612",
  "lastModified": "2026-09-25T15:18:01.500",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-25T11:17:15.330",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/011e17b5cae19b9f6a150923275e41c278de64f0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/78a86d75a70e1e227711c72865c59b1422d0a5ae"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b39120523475d6b436be7f6cb27d48064148a327"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Loading…

Loading…

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.


Loading…