CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: Fix the dead loop of MPLS parse
The unexpected MPLS packet may not end with the bottom label stack. When there are many stacks, The label count value has wrapped around. A dead loop occurs, soft lockup/CPU stuck finally.
stack backtrace: UBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26 index -1 is out of range for type 'be32 [3]' CPU: 34 PID: 0 Comm: swapper/34 Kdump: loaded Tainted: G OE 5.15.0-121-generic #131-Ubuntu Hardware name: Dell Inc. PowerEdge C6420/0JP9TF, BIOS 2.12.2 07/14/2021 Call Trace: <IRQ> showstack+0x52/0x5c dumpstacklvl+0x4a/0x63 dumpstack+0x10/0x16 ubsanepilogue+0x9/0x36 ubsanhandleoutofbounds.cold+0x44/0x49 keyextractl3l4+0x82a/0x840 [openvswitch] ? kfreeskbmem+0x52/0xa0 keyextract+0x9c/0x2b0 [openvswitch] ovsflowkeyextract+0x124/0x350 [openvswitch] ovsvportreceive+0x61/0xd0 [openvswitch] ? kernelinitfreepages.part.0+0x4a/0x70 ? getpagefromfreelist+0x353/0x540 netdevportreceive+0xc4/0x180 [openvswitch] ? netdevportreceive+0x180/0x180 [openvswitch] netdevframehook+0x1f/0x40 [openvswitch] netifreceiveskbcore.constprop.0+0x23a/0xf00 netifreceiveskblistcore+0xfa/0x240 netifreceiveskblistinternal+0x18e/0x2a0 napicompletedone+0x7a/0x1c0 bnxtpoll+0x155/0x1c0 [bnxten] napipoll+0x30/0x180 netrxaction+0x126/0x280 ? bnxtmsix+0x67/0x80 [bnxten] handlesoftirqs+0xda/0x2d0 irqexitrcu+0x96/0xc0 commoninterrupt+0x8e/0xa0 </IRQ>
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch UBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26 - Compensating control
If MPLS traffic is not required, restrict/block MPLS packets at the network/edge (e.g., drop/filter MPLS label stack traffic) to prevent triggering the Open vSwitch MPLS parse dead loop while patching.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38146?
CVE-2025-38146 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38146?
To fix CVE-2025-38146, update your Linux kernel to the latest stable release that contains the patch.
What are the potential impacts of CVE-2025-38146?
CVE-2025-38146 can lead to a denial of service due to a dead loop when processing certain MPLS packets.
Which versions of the Linux kernel are affected by CVE-2025-38146?
CVE-2025-38146 affects multiple versions of the Linux kernel prior to the patched update.
Is CVE-2025-38146 exploitable remotely?
CVE-2025-38146 can potentially be exploited by remote attackers sending crafted MPLS packets.