Executive brief
Open vSwitch is a widely-deployed virtual networking layer in Linux. A memory underflow vulnerability in packet truncation handling can allow an attacker to read or corrupt kernel memory when processing specially-crafted network traffic, potentially leading to denial of service or privilege escalation on systems running affected kernels.
Technical details
The vulnerability exists in the Open vSwitch module's handling of the OVS_ACTION_ATTR_TRUNC truncation action. The module stored a delta (cutlen) representing bytes to remove from packet length; when Generic Segmentation Offload (GSO) split a packet, this delta was reused on each smaller segment. If a segment became smaller than the delta, the resulting length calculation underflowed when passed to skb_zerocopy(), leading to a heap underflow. The fix changes storage from a "bytes to remove" delta to a "maximum bytes to preserve" value, uses U32_MAX as a sentinel, and bounds all consumers against the current skb length. No patch has been released for production kernel versions yet; the fix is currently in stable tree commits.
Affected products
- Linux Linux kernel all versions with openvswitch module (kernel 3.0+)
Timeline
- 2026-08-10: disclosed: CVE-2026-68123 published
- 2026-08-03: patched: Fix merged in stable linux trees (commit 100a23b1613e9...)
- 2026-07-07: other: Fix authored by Kyle Zeng