CVE-2025-68785

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix middle attribute validation in push_nsh() action

The push_nsh() action structure looks like this:

OVS_ACTION_ATTR_PUSH_NSH(OVS_KEY_ATTR_NSH(OVS_NSH_KEY_ATTR_BASE,...))

The outermost OVS_ACTION_ATTR_PUSH_NSH attribute is OK'ed by the

nla_for_each_nested() inside __ovs_nla_copy_actions(). The innermost

OVS_NSH_KEY_ATTR_BASE/MD1/MD2 are OK'ed by the nla_for_each_nested()

inside nsh_key_put_from_nlattr(). But nothing checks if the attribute

in the middle is OK. We don't even check that this attribute is the

OVS_KEY_ATTR_NSH. We just do a double unwrap with a pair of nla_data()

calls - first time directly while calling validate_push_nsh() and the

second time as part of the nla_for_each_nested() macro, which isn't

safe, potentially causing invalid memory access if the size of this

attribute is incorrect. The failure may not be noticed during

validation due to larger netlink buffer, but cause t

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References