CVE-2026-68123 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
openvswitch: fix GSO userspace truncation underflow
OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb length in OVS_CB(skb)->cutlen. When a later userspace action segments a GSO skb, queue_gso_packets() reuses that delta for each smaller segment. A segment can then reach queue_userspace_packet() with cutlen greater than skb->len, underflowing the length passed to skb_zerocopy().
Store the maximum preserved length instead and bound each consumer against the current skb length. Use U32_MAX as the no-truncation sentinel so the value remains valid if skb geometry changes before a consumer handles it.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability in question affects the Linux kernel's Open vSwitch implementation, specifically addressing a critical flaw in how GSO (Generic Segmentation Offload) packets are handled during userspace processing. This issue stems from improper management of packet truncation metadata within the OVS_CB(skb)->cutlen field, which creates a potential for integer underflow conditions that could lead to memory corruption or privilege escalation. The vulnerability occurs when OVS_ACTION_ATTR_TRUNC stores a delta value representing the original packet length, but fails to account for the dynamic nature of GSO segmentation operations that occur later in the packet processing pipeline.
The technical flaw manifests when queue_gso_packets() function reuses the stored delta value for each smaller segment created during GSO processing. This reuse pattern causes a fundamental mismatch between the expected packet length and the actual packet geometry, particularly when packets are segmented by userspace actions. When these segmented packets eventually reach queue_userspace_packet(), the cutlen field contains a value that exceeds the current skb->len, resulting in an integer underflow condition that corrupts memory structures used by skb_zerocopy(). This memory corruption can potentially be exploited to execute arbitrary code with kernel privileges, making it a severe security vulnerability that directly impacts the integrity and confidentiality of network operations within virtualized environments.
The operational impact of this vulnerability extends beyond simple packet processing failures to represent a potential attack vector for privilege escalation and system compromise. Systems utilizing Open vSwitch in virtualized environments or network function virtualization deployments are particularly at risk, as these configurations frequently employ GSO segmentation combined with userspace packet processing. The vulnerability affects any environment where OVS handles packets through userspace actions while also performing GSO segmentation, including cloud infrastructure platforms, software-defined networking deployments, and containerized environments that rely on Open vSwitch for network virtualization. The underflow condition specifically targets the zero-copy mechanism used for efficient packet transfer between kernel and userspace contexts, potentially allowing attackers to manipulate memory layout or execute malicious code with elevated privileges.
The fix implemented addresses this vulnerability by changing how truncation metadata is stored and consumed within the Open vSwitch codebase. Instead of storing a delta value from the original packet length, the solution maintains the maximum preserved length and bounds each consumer against the current skb length, ensuring that no underflow conditions can occur regardless of packet geometry changes during processing. The implementation uses U32_MAX as a sentinel value to indicate no truncation, which provides a robust mechanism that remains valid even if the underlying packet structure changes between when the value is set and when it's consumed. This approach aligns with established security practices for handling integer overflow and underflow conditions, while also ensuring compatibility across different kernel versions and packet processing scenarios.
This vulnerability classification maps to CWE-190, Integer Overflow or Wraparound, and CWE-129, Improper Validation of Array Index, as it involves improper handling of packet length calculations that can lead to memory corruption through integer underflow conditions. The attack surface aligns with ATT&CK techniques involving privilege escalation and code execution within kernel space, specifically targeting the network virtualization infrastructure. Organizations should prioritize patching this vulnerability in all environments using Open vSwitch, particularly those running virtualized workloads or software-defined networking solutions where GSO segmentation and userspace packet processing are actively utilized. The fix represents a defensive programming approach that prevents future similar issues by establishing robust bounds checking for packet length calculations within the OVS subsystem.