HIGH Introduced in 4.9
mpls LabelPop OOB
CVE-2026-97612
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear inner_protocol when the last label is popped skb_mpls_push() records the pre-encapsulation network header once, gated on !skb->inner_protocol. skb_mpls_pop() never clears that record, so it outlives the encapsulation it describes. Open vSwitch can then re-push MPLS onto a packet whose inner_network_header still points at the older, deeper offset: push a label, pop every label, recirculate (ovs_flow_key_update() re-derives key->eth.type and resets network_header, but leaves inner_*), then push again. ovs_fragment() trusts the record: skb->network_header = skb->inner_network_header; so skb_network_offset() goes negative. The bound check is signed: if (skb_network_offset(skb) > MAX_L2_LEN) a negative offset passes it, and prepare_frag() widens the value: unsigned int hlen = skb_network_offset(skb); memcpy(&data->l2_data, skb->data, hlen); which is a ~4GiB memcpy out of a 30-byte per-CPU buffer. Reproduced on v7.3-rc1. RDX is the truncated length, (unsigned int)(-8): BUG: unable to handle page fault for address: ffffe8ffffc16000 #PF: supervisor write access in kernel mode Oops: 0002 [#1] SMP KASAN NOPTI RIP: 0010:memcpy+0x8/0x20 RDX: 00000000fffffff8 RSI: ffff888105d732db RDI: ffffe8ffffc16000 prepare_frag+0x3df/0x4e0 ovs_fragment+0x589/0x7e0 do_output+0x4ce/0x5e0 do_execute_actions+0x55d2/0x7b30 ovs_execute_actions+0xea/0x450 Same root-cause shape as commit 975b5b067f52 ("ipv6: sr: restore network header before routing and forwarding"): a stale network header offset reaching a consumer that widens it. Here it originates in the MPLS push/pop path. Clear inner_protocol once the packet is no longer MPLS, so a later push re-records the current header. net/sched/act_mpls.c is the only other skb_mpls_pop() caller and gets the same fix; sch_frag.c saves and restores inner_protocol around fragmentation in the same way OVS does.
02KernelScan AI Analysis
Risk summary
A stale inner protocol header in the MPLS push/pop path causes a massive out-of-bounds memcpy during packet fragmentation, crashing the kernel and corrupting memory. The primary exploit path is through Open vSwitch, requiring privileged configuration, but the tc act_mpls path may be reachable from an unprivileged user namespace. Any device performing MPLS label manipulation and packet fragmentation is affected.
Vulnerability analysis
When the last MPLS label is removed from a packet, the kernel retains a stale record of where the underlying network header used to be. If a new label is later pushed onto the same packet after the current header location has been reset, that outdated saved position is still trusted. During fragmentation, the kernel copies packet data using a length derived from the difference between the stale saved location and the current data pointer. Because the saved location is behind the current pointer, the difference becomes negative, but the kernel then treats it as a very large positive number. This causes a massive memory copy that overflows a small internal buffer and crashes the system. The fix removes the saved header information whenever the final MPLS label is popped, so a later push records a fresh, correct position. The flaw can be triggered by local Open vSwitch forwarding rules or by traffic-control rules that manipulate MPLS labels and then fragment the packet; the traffic-control path may be reachable from an unprivileged account that creates a user namespace.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.9 | 5.10.271 | 55ed97db27bf |
| 5.15 | 4.9 | 5.15.222 | 833ec2788322 |
| 6.1 | 4.9 | 6.1.189 | 38db09804b26 |
| 6.12 | 4.9 | 6.12.111 | 011e17b5cae1 |
| 6.18 | 4.9 | 6.18.53 | da8c3a7f5d31 |
| 6.6 | 4.9 | 6.6.158 | 0b3425fd0ecd |
| 7.2 | 4.9 | 7.2.7 | b39120523475 |
| mainline | 4.9 | 7.3 | 78a86d75a70e |
| cip/5.10 | 4.9 | 5.10.271-cip78 | 55ed97db27bf |
| cip/6.1 | 4.9 | 6.1.189-cip61 | 38db09804b26 |
| cip/6.1-rt | 4.9 | 6.1.189-cip61-rt32 | 38db09804b26 |
| cip/6.12 | 4.9 | 6.12.111-cip32 | 011e17b5cae1 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |