UBUNTU-CVE-2026-99088: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: validate transport header presence in setipv6addr When executing IPv6 address rewrite actions on IPv6 fragments, setipv6addr() calls updateipv6checksum(). If parseipv6hdr() processes a non-first IPv6 fragment, it sets key->ip.proto to NEXTHDRFRAGMENT and returns early without calling skbsettransportheader(). updateipv6checksum() unconditionally evaluates skbtransportoffset() on entry before checking l4proto. Because skb->transportheader is uninitialized, this triggers a warning under CONFIGDEBUGNET=y although it is completely harmless. Fix this by returning early in updateipv6checksum() if l4proto is NEXTHDRFRAGMENT. This avoids reading the uninitialized transport offset for fragments while preserving the debug warning for any other protocol where the transport header is unexpectedly missing. See the syzbot trace: !skbtransportheaderwasset(skb) WARNING: ./include/linux/skbuff.h:3075 at skbtransportheader include/linux/skbuff.h:3075 [inline], CPU#1: syz-executor463/5635 WARNING: ./include/linux/skbuff.h:3075 at skbtransportoffset include/linux/skbuff.h:3250 [inline], CPU#1: syz-executor463/5635 WARNING: ./include/linux/skbuff.h:3075 at updateipv6checksum net/openvswitch/actions.c:361 [inline], CPU#1: syz-executor463/5635 WARNING: ./include/linux/skbuff.h:3075 at setipv6addr+0x462/0x660 net/openvswitch/actions.c:399, CPU#1: syz-executor463/5635 [...] RIP: 0010:skbtransportheader include/linux/skbuff.h:3075 [inline] RIP: 0010:skbtransportoffset include/linux/skbuff.h:3250 [inline] RIP: 0010:updateipv6checksum net/openvswitch/actions.c:361 [inline] RIP: 0010:setipv6addr+0x462/0x660 net/openvswitch/actions.c:399 [...] Call Trace: <TASK> setipv6 net/openvswitch/actions.c:531 [inline] doexecuteactions+0x557e/0x8600 net/openvswitch/actions.c:1366 ovsexecuteactions+0xde/0x520 net/openvswitch/actions.c:1592 ovspacketcmdexecute+0xb4f/0xf10 net/openvswitch/datapath.c:705 genlfamilyrcvmsgdoit+0x233/0x340 net/netlink/genetlink.c:1114 genlrcvmsg+0x614/0x7a0 net/netlink/genetlink.c:1209 netlinkrcvskb+0x226/0x4a0 net/netlink/afnetlink.c:2572 genlrcv+0x28/0x40 net/netlink/genetlink.c:1218 netlinkunicast+0x7bd/0x940 net/netlink/afnetlink.c:1361 netlinksendmsg+0x813/0xb40 net/netlink/afnetlink.c:1916 socksendmsgnosec+0x14e/0x190 net/socket.c:800
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Modify update_ipv6_checksum() to return early when l4_proto is NEXTHDR_FRAGMENT, before evaluating skb_transport_offset(), so non-first IPv6 fragments do not access an uninitialized transport header.
Event History
Frequently Asked Questions
Which systems are likely to exhibit the warning?
Systems using Open vSwitch that execute IPv6 address rewrite actions on non-first IPv6 fragments can trigger it. The warning is specifically observed when the kernel is built with CONFIG_DEBUG_NET=y.
Does this issue cause packet corruption or a functional failure?
The described uninitialized transport-offset read triggers a debug warning but is stated to be completely harmless. The fix skips checksum processing early for IPv6 fragments while retaining warnings for other protocols with unexpectedly missing transport headers.