CVE-2026-97612

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: mpls: clear inner_protocol when the last label is popped

skb_mpls_push() records the pre-encapsulation network header once, gated

on !skb->inner_protocol. skb_mpls_pop() never clears that record, so it

outlives the encapsulation it describes.

Open vSwitch can then re-push MPLS onto a packet whose

inner_network_header still points at the older, deeper offset: push a

label, pop every label, recirculate (ovs_flow_key_update() re-derives

key->eth.type and resets network_header, but leaves inner_*), then push

again. ovs_fragment() trusts the record:

skb->network_header = skb->inner_network_header;

so skb_network_offset() goes negative. The bound check is signed:

if (skb_network_offset(skb) > MAX_L2_LEN)

a negative offset passes it, and prepare_frag() widens the value:

unsigned int hlen = skb_network_offset(skb);

memcpy(&data->l2_data, skb->data, hlen);

which is a ~4GiB memcpy out of a 30-byte per-CPU buffe

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References