The vulnerability arises from the Linux kernel’s handling of MPLS label pushes and pops, where skb_mpls_push stores the pre‑encapsulation network header only when skb->inner_protocol is unset, but skb_mpls_pop never clears that record. When a packet is later re‑encapsulated, the stale inner_protocol value causes the packet’s inner network header to point to an incorrect offset. In Open vSwitch this leads to a negative offset that passes a signed bound check, triggering a 4 GiB memcpy from a 30‑byte per‑CPU buffer and resulting in a kernel panic. The resulting memory corruption can be exploited to gain elevated privileges or to cause denial of service.

All Linux kernel releases that contain the unpatched skb_mpls_push/pop logic, including recent mainline kernels prior to the patch. Systems running Open vSwitch on these kernels are affected by the interaction described.

The CVSS score is 7.8 and EPSS is < 1%. The bug is not listed in CISA’s KEV catalog. Attackers would need to craft MPLS traffic that triggers the re‑push/pop sequence in a system using Open vSwitch, so the principal vector is network traffic to a vulnerable switch. Because the flaw can lead to kernel panic or privilege escalation, the potential impact justifies immediate remediation.