CVE-2026-97612net: mpls: clear inner_protocol when the last label is popped
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear inner_protocol when the last label is popped skb_mpls_push() records the pre-encapsulation network header once, gated on !skb->inner_protocol. skb_mpls_pop() never clears that record, so it outlives the encapsulation it describes. Open vSwitch can then re-push MPLS onto a packet whose inner_network_header still points at the older, deeper offset: push a label, pop every label, recirculate (ovs_flow_key_update() re-derives key->eth.type and resets network_header, but leaves inner_*), then push again. ovs_fragment() trusts the record: skb->network_header = skb->inner_network_header; so skb_network_offset() goes negative. The bound check is signed: if (skb_network_offset(skb) > MAX_L2_LEN) a negative offset passes it, and prepare_frag() widens the value: unsigned int hlen = skb_network_offset(skb); memcpy(&data->l2_data, skb->data, hlen); which is a ~4GiB memcpy out of a 30-byte per-CPU buffer. Reproduced on v7.3-rc1. RDX is the truncated length, (unsigned int)(-8): BUG: unable to handle page fault for address: ffffe8ffffc16000 #PF: supervisor write access in kernel mode Oops: 0002 [#1] SMP KASAN NOPTI RIP: 0010:memcpy+0x8/0x20 RDX: 00000000fffffff8 RSI: ffff888105d732db RDI: ffffe8ffffc16000 prepare_frag+0x3df/0x4e0 ovs_fragment+0x589/0x7e0 do_output+0x4ce/0x5e0 do_execute_actions+0x55d2/0x7b30 ovs_execute_actions+0xea/0x450 Same root-cause shape as commit 975b5b067f52 ("ipv6: sr: restore network header before routing and forwarding"): a stale network header offset reaching a consumer that widens it. Here it originates in the MPLS push/pop path. Clear inner_protocol once the packet is no longer MPLS, so a later push re-records the current header. net/sched/act_mpls.c is the only other skb_mpls_pop() caller and gets the same fix; sch_frag.c saves and restores inner_protocol around fragmentation in the same way OVS does.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 48d2ab609b6bbecb7698487c8579bc40de9d6dfa before 55ed97db27bffe29c21fdefd5d25601322c36ff8; from 48d2ab609b6bbecb7698487c8579bc40de9d6dfa before 833ec2788322306407503b4cfc7745cd1f9d785f; 48d2ab609b6bbecb7698487c8579bc40de9d6dfa builds before 38db09804b2616aa1e2fcdf97f0c3ae8b9dbdd34; 48d2ab609b6bbecb7698487c8579bc40de9d6dfa builds before 0b3425fd0ecd515997956f7bb8a8a576b444ed64; 48d2ab609b6bbecb7698487c8579bc40de9d6dfa builds before 011e17b5cae19b9f6a150923275e41c278de64f0; from 48d2ab609b6bbecb7698487c8579bc40de9d6dfa before da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e; from 48d2ab609b6bbecb7698487c8579bc40de9d6dfa before b39120523475d6b436be7f6cb27d48064148a327; from 48d2ab609b6bbecb7698487c8579bc40de9d6dfa before 78a86d75a70e1e227711c72865c59b1422d0a5ae | CNA record |
References
- https://git.kernel.org/stable/c/55ed97db27bffe29c21fdefd5d25601322c36ff8
- https://git.kernel.org/stable/c/833ec2788322306407503b4cfc7745cd1f9d785f
- https://git.kernel.org/stable/c/38db09804b2616aa1e2fcdf97f0c3ae8b9dbdd34
- https://git.kernel.org/stable/c/0b3425fd0ecd515997956f7bb8a8a576b444ed64
- https://git.kernel.org/stable/c/011e17b5cae19b9f6a150923275e41c278de64f0
- https://git.kernel.org/stable/c/da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e
- https://git.kernel.org/stable/c/b39120523475d6b436be7f6cb27d48064148a327
- https://git.kernel.org/stable/c/78a86d75a70e1e227711c72865c59b1422d0a5ae
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.