CVE-2026-68123: openvswitch: fix GSO userspace truncation underflow
In the Linux kernel, the following vulnerability has been resolved:
openvswitch: fix GSO userspace truncation underflow
OVSACTIONATTRTRUNC currently stores a delta from the original skb length in OVSCB(skb)->cutlen. When a later userspace action segments a GSO skb, queuegsopackets() reuses that delta for each smaller segment. A segment can then reach queueuserspacepacket() with cutlen greater than skb->len, underflowing the length passed to skbzerocopy().
Store the maximum preserved length instead and bound each consumer against the current skb length. Use U32MAX as the no-truncation sentinel so the value remains valid if skb geometry changes before a consumer handles it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openvswitchto a version that resolves this vulnerability.Patch OVS_ACTION_ATTR_TRUNC
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68123?
CVE-2026-68123 has a risk score of 37, indicating a moderate severity level.
How do I fix CVE-2026-68123?
To fix CVE-2026-68123, update the Linux kernel to the latest version where the vulnerability has been patched.
What impact does CVE-2026-68123 have on my system?
CVE-2026-68123 can lead to potential data corruption and security issues when processing GSO (Generic Segmentation Offload) packets.
Is CVE-2026-68123 an exploitable vulnerability?
Yes, CVE-2026-68123 could be exploited by attackers to manipulate the GSO packet handling process, affecting system stability.
What software versions are affected by CVE-2026-68123?
CVE-2026-68123 affects specific versions of the Linux kernel that utilize openvswitch for network packet handling.