CVE-2026-99088 - Vulnerability Details

- net: openvswitch: validate transport header presence in set_ipv6_addr

Description

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: validate transport header presence in set_ipv6_addr

When executing IPv6 address rewrite actions on IPv6 fragments,
set_ipv6_addr() calls update_ipv6_checksum(). If parse_ipv6hdr()
processes a non-first IPv6 fragment, it sets key->ip.proto to
NEXTHDR_FRAGMENT and returns early without calling
skb_set_transport_header().

update_ipv6_checksum() unconditionally evaluates skb_transport_offset()
on entry before checking l4_proto. Because skb->transport_header is
uninitialized, this triggers a warning under CONFIG_DEBUG_NET=y although
it is completely harmless.

Fix this by returning early in update_ipv6_checksum() if l4_proto is
NEXTHDR_FRAGMENT. This avoids reading the uninitialized transport offset
for fragments while preserving the debug warning for any other protocol
where the transport header is unexpectedly missing.

See the syzbot trace:

!skb_transport_header_was_set(skb)
WARNING: ./include/linux/skbuff.h:3075 at skb_transport_header include/linux/skbuff.h:3075 [inline], CPU#1: syz-executor463/5635
WARNING: ./include/linux/skbuff.h:3075 at skb_transport_offset include/linux/skbuff.h:3250 [inline], CPU#1: syz-executor463/5635
WARNING: ./include/linux/skbuff.h:3075 at update_ipv6_checksum net/openvswitch/actions.c:361 [inline], CPU#1: syz-executor463/5635
WARNING: ./include/linux/skbuff.h:3075 at set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399, CPU#1: syz-executor463/5635
[...]
RIP: 0010:skb_transport_header include/linux/skbuff.h:3075 [inline]
RIP: 0010:skb_transport_offset include/linux/skbuff.h:3250 [inline]
RIP: 0010:update_ipv6_checksum net/openvswitch/actions.c:361 [inline]
RIP: 0010:set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399
[...]
Call Trace:
<TASK>
set_ipv6 net/openvswitch/actions.c:531 [inline]
do_execute_actions+0x557e/0x8600 net/openvswitch/actions.c:1366
ovs_execute_actions+0xde/0x520 net/openvswitch/actions.c:1592
ovs_packet_cmd_execute+0xb4f/0xf10 net/openvswitch/datapath.c:705
genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114
genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2572
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1916
sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800

Published: 2026-10-26

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a kernel bug in the Open vSwitch implementation that causes the function update_ipv6_checksum() to access an uninitialized transport header offset when processing non‑first IPv6 fragments. The bug only triggers a debug warning under CONFIG_DEBUG_NET=y and is otherwise harmless; it does not provide any code execution, privilege escalation or information disclosure pathway.

Affected Systems

All Linux kernel distributions that include the Open vSwitch component are affected, regardless of vendor. The specific kernel versions are not listed, but the issue appears in any kernel where the buggy commit is present in the openvswitch source tree.

Risk and Exploitability

Because the flaw is limited to a harmless debug warning and no exploit path exists, the risk is extremely low. Neither CVSS nor EPSS scores are available, and the vulnerability is not listed in CISA's KEV catalog, confirming that no active exploitation is known. The likely attack vector is internal traffic handled by Open vSwitch; no external exploitation is possible from this bug.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3fdbd1ce11e5c0d7cafbe44c942c5cad61113d7b`	affected	< b7b80d204abdc258006f9e17c92b363ab13bb599
`3fdbd1ce11e5c0d7cafbe44c942c5cad61113d7b`	affected	< 6774af7cd17be8f0d0f70de3a749d381b4f2e9da
`3fdbd1ce11e5c0d7cafbe44c942c5cad61113d7b`	affected	< 2594795fd832f0253826d64ff8976b8ff5fbfe9f
`3fdbd1ce11e5c0d7cafbe44c942c5cad61113d7b`	affected	< 6b8897ba0733f88f0360ea48a970f373f9142de0
`3fdbd1ce11e5c0d7cafbe44c942c5cad61113d7b`	affected	< 3c6a4b11330fe424557538a98fca9f0a4c5bf313

Linux

affected

Version	Status	Constraints
`3.8`	affected	—
`0`	unaffected	< 3.8
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`7.2.11`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the Open vSwitch patch returning early in update_ipv6_checksum for NEXTHDR_FRAGMENT.
If a kernel upgrade cannot be performed immediately, apply the patch that inserts the early return for fragment transport headers to the Open vSwitch source code.
After applying the fix, verify that the debug warning "skb_transport_header_was_set" no longer appears in kernel logs.

Generated by OpenCVE AI on October 26, 2026 at 16:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2594795fd832f0253826d64ff8976b8ff5fbfe9f
https://git.kernel.org/stable/c/3c6a4b11330fe424557538a98fca9f0a4c5bf313
https://git.kernel.org/stable/c/6774af7cd17be8f0d0f70de3a749d381b4f2e9da
https://git.kernel.org/stable/c/6b8897ba0733f88f0360ea48a970f373f9142de0
https://git.kernel.org/stable/c/b7b80d204abdc258006f9e17c92b363ab13bb599

History

Mon, 26 Oct 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-457

Mon, 26 Oct 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: validate transport header presence in set_ipv6_addr When executing IPv6 address rewrite actions on IPv6 fragments, set_ipv6_addr() calls update_ipv6_checksum(). If parse_ipv6hdr() processes a non-first IPv6 fragment, it sets key->ip.proto to NEXTHDR_FRAGMENT and returns early without calling skb_set_transport_header(). update_ipv6_checksum() unconditionally evaluates skb_transport_offset() on entry before checking l4_proto. Because skb->transport_header is uninitialized, this triggers a warning under CONFIG_DEBUG_NET=y although it is completely harmless. Fix this by returning early in update_ipv6_checksum() if l4_proto is NEXTHDR_FRAGMENT. This avoids reading the uninitialized transport offset for fragments while preserving the debug warning for any other protocol where the transport header is unexpectedly missing. See the syzbot trace: !skb_transport_header_was_set(skb) WARNING: ./include/linux/skbuff.h:3075 at skb_transport_header include/linux/skbuff.h:3075 [inline], CPU#1: syz-executor463/5635 WARNING: ./include/linux/skbuff.h:3075 at skb_transport_offset include/linux/skbuff.h:3250 [inline], CPU#1: syz-executor463/5635 WARNING: ./include/linux/skbuff.h:3075 at update_ipv6_checksum net/openvswitch/actions.c:361 [inline], CPU#1: syz-executor463/5635 WARNING: ./include/linux/skbuff.h:3075 at set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399, CPU#1: syz-executor463/5635 [...] RIP: 0010:skb_transport_header include/linux/skbuff.h:3075 [inline] RIP: 0010:skb_transport_offset include/linux/skbuff.h:3250 [inline] RIP: 0010:update_ipv6_checksum net/openvswitch/actions.c:361 [inline] RIP: 0010:set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399 [...] Call Trace: <TASK> set_ipv6 net/openvswitch/actions.c:531 [inline] do_execute_actions+0x557e/0x8600 net/openvswitch/actions.c:1366 ovs_execute_actions+0xde/0x520 net/openvswitch/actions.c:1592 ovs_packet_cmd_execute+0xb4f/0xf10 net/openvswitch/datapath.c:705 genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114 genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2572 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218 netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1916 sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800
Title		net: openvswitch: validate transport header presence in set_ipv6_addr
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2594795fd832f0253826d64ff8976b8ff5fbfe9f https://git.kernel.org/stable/c/3c6a4b11330fe424557538a98fca9f0a4c5bf313 https://git.kernel.org/stable/c/6774af7cd17be8f0d0f70de3a749d381b4f2e9da https://git.kernel.org/stable/c/6b8897ba0733f88f0360ea48a970f373f9142de0 https://git.kernel.org/stable/c/b7b80d204abdc258006f9e17c92b363ab13bb599

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-26T14:51:58.460Z

Updated: 2026-10-26T14:51:58.460Z

Reserved: 2026-09-25T10:25:14.390Z

Link: CVE-2026-99088

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-26T15:16:47.517

Modified: 2026-10-26T15:16:47.517

Link: CVE-2026-99088

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-26T16:45:14Z

Weaknesses

CWE-457
Use of Uninitialized Variable

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object