In the Linux kernel, the following vulnerability has been resolved:
openvswitch: validate MPLS set/setmasked payload length
validateset() accepted OVSKEYATTRMPLS as variable-sized payload for SET/SETMASKED actions. In action handling, OVS expects fixed-size MPLS key data (struct ovskeympls).
Use the already normalized keylen (masked case included) and reject non-matching MPLS action key sizes.
Reject invalid MPLS action payload lengths early.