Description

In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear inner_protocol when the last label is popped skb_mpls_push() records the pre-encapsulation network header once, gated on !skb->inner_protocol. skb_mpls_pop() never clears that record, so it outlives the encapsulation it describes. Open vSwitch can then re-push MPLS onto a packet whose inner_network_header still points at the older, deeper offset: push a label, pop every label, recirculate (ovs_flow_key_update() re-derives key->eth.type and resets network_header, but leaves inner_*), then push again. ovs_fragment() trusts the record: skb->network_header = skb->inner_network_header; so skb_network_offset() goes negative. The bound check is signed: if (skb_network_offset(skb) > MAX_L2_LEN) a negative offset passes it, and prepare_frag() widens the value: unsigned int hlen = skb_network_offset(skb); memcpy(&data->l2_data, skb->data, hlen); which is a ~4GiB memcpy out of a 30-byte per-CPU buffer. Reproduced on v7.3-rc1. RDX is the truncated length, (unsigned int)(-8): BUG: unable to handle page fault for address: ffffe8ffffc16000 #PF: supervisor write access in kernel mode Oops: 0002 [#1] SMP KASAN NOPTI RIP: 0010:memcpy+0x8/0x20 RDX: 00000000fffffff8 RSI: ffff888105d732db RDI: ffffe8ffffc16000 prepare_frag+0x3df/0x4e0 ovs_fragment+0x589/0x7e0 do_output+0x4ce/0x5e0 do_execute_actions+0x55d2/0x7b30 ovs_execute_actions+0xea/0x450 Same root-cause shape as commit 975b5b067f52 ("ipv6: sr: restore network header before routing and forwarding"): a stale network header offset reaching a consumer that widens it. Here it originates in the MPLS push/pop path. Clear inner_protocol once the packet is no longer MPLS, so a later push re-records the current header. net/sched/act_mpls.c is the only other skb_mpls_pop() caller and gets the same fix; sch_frag.c saves and restores inner_protocol around fragmentation in the same way OVS does.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-25T11:17:15.330Z",
  "pubdate": "2026-09-25T11:17:15.330Z",
  "executiveSummary": "A memory corruption vulnerability exists in the Linux kernel's MPLS implementation due to improper handling of the inner_protocol metadata during MPLS label popping operations.\nThe vulnerability occurs because skb_mpls_pop() fails to clear the inner_protocol field after removing the last MPLS label, leaving stale metadata that erroneously describes the packet's encapsulation state.\nThis inconsistency can be leveraged by subsystems like Open vSwitch (OVS) to trigger a large, out-of-bounds memcpy operation by forcing an invalid calculation of the network header offset.\nImpact includes kernel memory corruption, potential privilege escalation, or system crashes via a kernel panic (Denial of Service).\nThe attack is remotely exploitable in environments where an attacker can craft and inject MPLS-labeled packets that transit through affected OVS datapaths.\nSuccessful exploitation requires the ability to reach specific packet processing paths where inner_network_header is trusted for fragmentation logic, resulting in a signed integer underflow vulnerability.",
  "technicalDetails": "The root cause is a stale metadata state within the sk_buff (skb) structure. When skb_mpls_push() is invoked, the kernel records the current network header offset in inner_network_header and sets inner_protocol, gated by a check to ensure it is only recorded once. However, the corresponding skb_mpls_pop() function fails to reset these fields when the final MPLS label is removed.\nThis leaves the inner_network_header pointing to an offset that no longer accurately reflects the packet's actual protocol stack. When a packet is processed by Open vSwitch, specifically through ovs_flow_key_update(), the network header may be reset, but the stale inner_network_header persists.\nThe exploitation flow triggers when ovs_fragment() is called. This function performs the assignment 'skb->network_header = skb->inner_network_header;'. Because the inner_network_header reflects an old, deeper offset from a previous encapsulation state, the resulting skb_network_offset(skb) calculation yields a negative value.\nIn the Linux kernel's fragmentation logic, the bounds check 'if (skb_network_offset(skb) > MAX_L2_LEN)' uses a signed comparison. A negative value evaluates to true (passing the bounds check), allowing the kernel to proceed to prepare_frag().\nInside prepare_frag(), the kernel executes 'unsigned int hlen = skb_network_offset(skb);' followed by 'memcpy(&data->l2_data, skb->data, hlen);'. Because hlen is cast to an unsigned integer, the negative value (e.g., -8) becomes a massive unsigned integer (e.g., 4,294,967,288).\nThis causes a massive, out-of-bounds memcpy operation originating from a small per-CPU buffer, leading to memory corruption, potential information disclosure of adjacent kernel memory, or a system crash due to a page fault/invalid memory access.\nThe vulnerability affects kernel versions up to v7.3-rc1. Any component that relies on the consistency of the inner_protocol and inner_network_header fields following an MPLS pop operation is susceptible to this logic error.\nThe attack surface involves the processing of MPLS-encapsulated traffic, particularly when routed through Open vSwitch or other virtual networking components that manage fragmentation and protocol header restoration."
}