CVE-2026-99088: net: openvswitch: validate transport header presence in set_ipv6_addr
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: validate transport header presence in setipv6addr
When executing IPv6 address rewrite actions on IPv6 fragments, setipv6addr() calls updateipv6checksum(). If parseipv6hdr() processes a non-first IPv6 fragment, it sets key->ip.proto to NEXTHDRFRAGMENT and returns early without calling skbsettransportheader().
updateipv6checksum() unconditionally evaluates skbtransportoffset() on entry before checking l4proto. Because skb->transportheader is uninitialized, this triggers a warning under CONFIGDEBUGNET=y although it is completely harmless.
Fix this by returning early in updateipv6checksum() if l4proto is NEXTHDRFRAGMENT. This avoids reading the uninitialized transport offset for fragments while preserving the debug warning for any other protocol where the transport header is unexpectedly missing.
See the syzbot trace:
!skbtransportheaderwasset(skb) WARNING: ./include/linux/skbuff.h:3075 at skbtransportheader include/linux/skbuff.h:3075 [inline], CPU#1: syz-executor463/5635 WARNING: ./include/linux/skbuff.h:3075 at skbtransportoffset include/linux/skbuff.h:3250 [inline], CPU#1: syz-executor463/5635 WARNING: ./include/linux/skbuff.h:3075 at updateipv6checksum net/openvswitch/actions.c:361 [inline], CPU#1: syz-executor463/5635 WARNING: ./include/linux/skbuff.h:3075 at setipv6addr+0x462/0x660 net/openvswitch/actions.c:399, CPU#1: syz-executor463/5635 [...] RIP: 0010:skbtransportheader include/linux/skbuff.h:3075 [inline] RIP: 0010:skbtransportoffset include/linux/skbuff.h:3250 [inline] RIP: 0010:updateipv6checksum net/openvswitch/actions.c:361 [inline] RIP: 0010:setipv6addr+0x462/0x660 net/openvswitch/actions.c:399 [...] Call Trace: <TASK> setipv6 net/openvswitch/actions.c:531 [inline] doexecuteactions+0x557e/0x8600 net/openvswitch/actions.c:1366 ovsexecuteactions+0xde/0x520 net/openvswitch/actions.c:1592 ovspacketcmdexecute+0xb4f/0xf10 net/openvswitch/datapath.c:705 genlfamilyrcvmsgdoit+0x233/0x340 net/netlink/genetlink.c:1114 genlrcvmsg+0x614/0x7a0 net/netlink/genetlink.c:1209 netlinkrcvskb+0x226/0x4a0 net/netlink/afnetlink.c:2572 genlrcv+0x28/0x40 net/netlink/genetlink.c:1218 netlinkunicast+0x7bd/0x940 net/netlink/afnetlink.c:1361 netlinksendmsg+0x813/0xb40 net/netlink/afnetlink.c:1916 socksendmsgnosec+0x14e/0x190 net/socket.c:800
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In net/openvswitch, validate transport-header presence in set_ipv6_addr(): have update_ipv6_checksum() return early when l4_proto is NEXTHDR_FRAGMENT, before evaluating skb_transport_offset(), while preserving the debug warning for other protocols.