https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 15:50:59 +0000 https://vulnerability.circl.lu/vuln/cve-2026-68123 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>openvswitch: fix GSO userspace truncation underflow</p> <p>OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb length in OVS_CB(skb)-&gt;cutlen. When a later userspace action segments a GSO skb, queue_gso_packets() reuses that delta for each smaller segment. A segment can then reach queue_userspace_packet() with cutlen greater than skb-&gt;len, underflowing the length passed to skb_zerocopy().</p> <p>Store the maximum preserved length instead and bound each consumer against the current skb length. Use U32_MAX as the no-truncation sentinel so the value remains valid if skb geometry changes before a consumer handles it.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>openvswitch: fix GSO userspace truncation underflow</p> <p>OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb length in OVS_CB(skb)-&gt;cutlen. When a later userspace action segments a GSO skb, queue_gso_packets() reuses that delta for each smaller segment. A segment can then reach queue_userspace_packet() with cutlen greater than skb-&gt;len, underflowing the length passed to skb_zerocopy().</p> <p>Store the maximum preserved length instead and bound each consumer against the current skb length. Use U32_MAX as the no-truncation sentinel so the value remains valid if skb geometry changes before a consumer handles it.</p> https://vulnerability.circl.lu/vuln/cve-2026-68123