CVE-2026-97612 (GCVE-0-2026-97612)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:22 – Updated: 2026-09-25 14:41
VLAI
Title
net: mpls: clear inner_protocol when the last label is popped
Summary
In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear inner_protocol when the last label is popped skb_mpls_push() records the pre-encapsulation network header once, gated on !skb->inner_protocol. skb_mpls_pop() never clears that record, so it outlives the encapsulation it describes. Open vSwitch can then re-push MPLS onto a packet whose inner_network_header still points at the older, deeper offset: push a label, pop every label, recirculate (ovs_flow_key_update() re-derives key->eth.type and resets network_header, but leaves inner_*), then push again. ovs_fragment() trusts the record: skb->network_header = skb->inner_network_header; so skb_network_offset() goes negative. The bound check is signed: if (skb_network_offset(skb) > MAX_L2_LEN) a negative offset passes it, and prepare_frag() widens the value: unsigned int hlen = skb_network_offset(skb); memcpy(&data->l2_data, skb->data, hlen); which is a ~4GiB memcpy out of a 30-byte per-CPU buffer. Reproduced on v7.3-rc1. RDX is the truncated length, (unsigned int)(-8): BUG: unable to handle page fault for address: ffffe8ffffc16000 #PF: supervisor write access in kernel mode Oops: 0002 [#1] SMP KASAN NOPTI RIP: 0010:memcpy+0x8/0x20 RDX: 00000000fffffff8 RSI: ffff888105d732db RDI: ffffe8ffffc16000 prepare_frag+0x3df/0x4e0 ovs_fragment+0x589/0x7e0 do_output+0x4ce/0x5e0 do_execute_actions+0x55d2/0x7b30 ovs_execute_actions+0xea/0x450 Same root-cause shape as commit 975b5b067f52 ("ipv6: sr: restore network header before routing and forwarding"): a stale network header offset reaching a consumer that widens it. Here it originates in the MPLS push/pop path. Clear inner_protocol once the packet is no longer MPLS, so a later push re-records the current header. net/sched/act_mpls.c is the only other skb_mpls_pop() caller and gets the same fix; sch_frag.c saves and restores inner_protocol around fragmentation in the same way OVS does.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 48d2ab609b6bbecb7698487c8579bc40de9d6dfa , < 011e17b5cae19b9f6a150923275e41c278de64f0 (git)
Affected: 48d2ab609b6bbecb7698487c8579bc40de9d6dfa , < da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e (git)
Affected: 48d2ab609b6bbecb7698487c8579bc40de9d6dfa , < b39120523475d6b436be7f6cb27d48064148a327 (git)
Affected: 48d2ab609b6bbecb7698487c8579bc40de9d6dfa , < 78a86d75a70e1e227711c72865c59b1422d0a5ae (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.9
Unaffected: 0 , < 4.9 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "011e17b5cae19b9f6a150923275e41c278de64f0",
              "status": "affected",
              "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa",
              "versionType": "git"
            },
            {
              "lessThan": "da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e",
              "status": "affected",
              "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa",
              "versionType": "git"
            },
            {
              "lessThan": "b39120523475d6b436be7f6cb27d48064148a327",
              "status": "affected",
              "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa",
              "versionType": "git"
            },
            {
              "lessThan": "78a86d75a70e1e227711c72865c59b1422d0a5ae",
              "status": "affected",
              "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mpls: clear inner_protocol when the last label is popped\n\nskb_mpls_push() records the pre-encapsulation network header once, gated\non !skb-\u003einner_protocol. skb_mpls_pop() never clears that record, so it\noutlives the encapsulation it describes.\n\nOpen vSwitch can then re-push MPLS onto a packet whose\ninner_network_header still points at the older, deeper offset: push a\nlabel, pop every label, recirculate (ovs_flow_key_update() re-derives\nkey-\u003eeth.type and resets network_header, but leaves inner_*), then push\nagain. ovs_fragment() trusts the record:\n\n\tskb-\u003enetwork_header = skb-\u003einner_network_header;\n\nso skb_network_offset() goes negative. The bound check is signed:\n\n\tif (skb_network_offset(skb) \u003e MAX_L2_LEN)\n\na negative offset passes it, and prepare_frag() widens the value:\n\n\tunsigned int hlen = skb_network_offset(skb);\n\tmemcpy(\u0026data-\u003el2_data, skb-\u003edata, hlen);\n\nwhich is a ~4GiB memcpy out of a 30-byte per-CPU buffer.\n\nReproduced on v7.3-rc1. RDX is the truncated length, (unsigned int)(-8):\n\n  BUG: unable to handle page fault for address: ffffe8ffffc16000\n  #PF: supervisor write access in kernel mode\n  Oops: 0002 [#1] SMP KASAN NOPTI\n  RIP: 0010:memcpy+0x8/0x20\n  RDX: 00000000fffffff8 RSI: ffff888105d732db RDI: ffffe8ffffc16000\n   prepare_frag+0x3df/0x4e0\n   ovs_fragment+0x589/0x7e0\n   do_output+0x4ce/0x5e0\n   do_execute_actions+0x55d2/0x7b30\n   ovs_execute_actions+0xea/0x450\n\nSame root-cause shape as commit 975b5b067f52 (\"ipv6: sr: restore network\nheader before routing and forwarding\"): a stale network header offset\nreaching a consumer that widens it. Here it originates in the MPLS\npush/pop path.\n\nClear inner_protocol once the packet is no longer MPLS, so a later push\nre-records the current header. net/sched/act_mpls.c is the only other\nskb_mpls_pop() caller and gets the same fix; sch_frag.c saves and\nrestores inner_protocol around fragmentation in the same way OVS does."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The stale inner_network_header comes from OVS flow actions (push_mpls, pop_mpls, recirc, push_mpls) that the attacker installs over the ovs_flow/ovs_packet generic netlink families. No field of a received packet causes the bad offset, so the vector is local netlink rather than the wire.\nAC:L - The attacker chooses the flow action sequence and the oversized packet that sends do_output into ovs_fragment(). skb_mpls_pop() then deterministically leaves inner_protocol set, and the negative offset always passes the signed MAX_L2_LEN check, so nothing depends on timing or outside state.\nPR:L - The OVS datapath, vport, flow and packet genl operations use GENL_UNS_ADMIN_PERM with netnsok=true. That means CAP_NET_ADMIN inside an unprivileged user and network namespace (unshare -Urn) is enough to create a datapath, install the flows and execute packets.\nUI:N - No victim action is needed. The attacker installs the flows and injects or sends the packet themselves inside their own namespace.\nS:U - The overflow corrupts memory of the same kernel that performs the check. This is ordinary in-kernel memory corruption and crosses no hypervisor or IOMMU boundary.\nC:H - prepare_frag() turns a negative skb_network_offset() into an unsigned hlen of about 4 GiB and memcpy()s attacker packet bytes past the 30-byte per-CPU ovs_frag_data.l2_data. The write covers exec_level, owner, bh_lock and the per-CPU data that follows, and memory corruption of this kind can be leveraged for information disclosure.\nI:H - This is an out-of-bounds write of attacker-controlled skb data into the per-CPU ovs_pcpu_storage and the per-CPU memory after it, including a task_struct pointer (owner) and lock state. The corruption stays in place if the oops happens in process context (OVS_PACKET_CMD_EXECUTE).\nA:H - The runaway memcpy in prepare_frag() always runs until it hits an unmapped per-CPU page and oopses, as the fix\u0027s reproducer shows (write fault in memcpy from prepare_frag/ovs_fragment). The attacker can repeat this at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:34.217Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/011e17b5cae19b9f6a150923275e41c278de64f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e"
        },
        {
          "url": "https://git.kernel.org/stable/c/b39120523475d6b436be7f6cb27d48064148a327"
        },
        {
          "url": "https://git.kernel.org/stable/c/78a86d75a70e1e227711c72865c59b1422d0a5ae"
        }
      ],
      "title": "net: mpls: clear inner_protocol when the last label is popped",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97612",
    "datePublished": "2026-09-25T10:22:21.423Z",
    "dateReserved": "2026-09-24T16:01:01.158Z",
    "dateUpdated": "2026-09-25T14:41:34.217Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-97612",
      "date": "2026-09-28",
      "epss": "0.00163",
      "percentile": "0.04906"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-28T00:40:11.000Z",
      "cve": "CVE-2026-97612",
      "id": "msrc_CVE-2026-97612",
      "initial_release_date": "2026-09-28T00:40:11.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: mpls: clear inner_protocol when the last label is popped",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-97612.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/core/skbuff.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "011e17b5cae19b9f6a150923275e41c278de64f0",
                    "status": "affected",
                    "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e",
                    "status": "affected",
                    "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b39120523475d6b436be7f6cb27d48064148a327",
                    "status": "affected",
                    "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "78a86d75a70e1e227711c72865c59b1422d0a5ae",
                    "status": "affected",
                    "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/core/skbuff.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.9"
                  },
                  {
                    "lessThan": "4.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mpls: clear inner_protocol when the last label is popped\n\nskb_mpls_push() records the pre-encapsulation network header once, gated\non !skb-\u003einner_protocol. skb_mpls_pop() never clears that record, so it\noutlives the encapsulation it describes.\n\nOpen vSwitch can then re-push MPLS onto a packet whose\ninner_network_header still points at the older, deeper offset: push a\nlabel, pop every label, recirculate (ovs_flow_key_update() re-derives\nkey-\u003eeth.type and resets network_header, but leaves inner_*), then push\nagain. ovs_fragment() trusts the record:\n\n\tskb-\u003enetwork_header = skb-\u003einner_network_header;\n\nso skb_network_offset() goes negative. The bound check is signed:\n\n\tif (skb_network_offset(skb) \u003e MAX_L2_LEN)\n\na negative offset passes it, and prepare_frag() widens the value:\n\n\tunsigned int hlen = skb_network_offset(skb);\n\tmemcpy(\u0026data-\u003el2_data, skb-\u003edata, hlen);\n\nwhich is a ~4GiB memcpy out of a 30-byte per-CPU buffer.\n\nReproduced on v7.3-rc1. RDX is the truncated length, (unsigned int)(-8):\n\n  BUG: unable to handle page fault for address: ffffe8ffffc16000\n  #PF: supervisor write access in kernel mode\n  Oops: 0002 [#1] SMP KASAN NOPTI\n  RIP: 0010:memcpy+0x8/0x20\n  RDX: 00000000fffffff8 RSI: ffff888105d732db RDI: ffffe8ffffc16000\n   prepare_frag+0x3df/0x4e0\n   ovs_fragment+0x589/0x7e0\n   do_output+0x4ce/0x5e0\n   do_execute_actions+0x55d2/0x7b30\n   ovs_execute_actions+0xea/0x450\n\nSame root-cause shape as commit 975b5b067f52 (\"ipv6: sr: restore network\nheader before routing and forwarding\"): a stale network header offset\nreaching a consumer that widens it. Here it originates in the MPLS\npush/pop path.\n\nClear inner_protocol once the packet is no longer MPLS, so a later push\nre-records the current header. net/sched/act_mpls.c is the only other\nskb_mpls_pop() caller and gets the same fix; sch_frag.c saves and\nrestores inner_protocol around fragmentation in the same way OVS does."
          }
        ],
        "id": "CVE-2026-97612",
        "lastModified": "2026-09-25T15:18:01.500",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-25T11:17:15.330",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/011e17b5cae19b9f6a150923275e41c278de64f0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/78a86d75a70e1e227711c72865c59b1422d0a5ae"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b39120523475d6b436be7f6cb27d48064148a327"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.