Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-31679

openvswitch: validate MPLS set/set_masked payload length

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: openvswitch: validate MPLS set/set_masked payload length validate_set() accepted OVS_KEY_ATTR_MPLS as variable-sized payload for SET/SET_MASKED actions. In action handling, OVS expects fixed-size MPLS key data (struct ovs_key_mpls). Use the already normalized key_len (masked case included) and reject non-matching MPLS action key sizes. Reject invalid MPLS action payload lengths early.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3 to < 68f32ef0683c8d1c05cd2e4f16818fa63ff59c6faffected
  • fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3 to < 4cae986225f8b8679ad86b924918e7d75a96aa61affected
  • fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3 to < 8ed7b9930cbc3bc71f868fa79a68700ac88d586aaffected
  • fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3 to < c1f97152df8dfb17e855ddf0fc409b7bd13e9700affected
  • fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3 to < 98de18d327ef8cbbb704980e359e4872d8c28997affected
  • fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3 to < bd50c7484c3bb34097571c1334174fb8b7408036affected
  • fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3 to < 2ca33b88a79ca42f017ae0f7011280325655438eaffected
  • fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3 to < 546b68ac893595877ffbd7751e5c55fd1c43ede6affected

Linux Linux

Default version status: affected

  • 5.5affected
  • 0 to < 5.5unaffected
  • 5.10.253 to ≤ 5.10.*unaffected
  • 5.15.203 to ≤ 5.15.*unaffected
  • 6.1.168 to ≤ 6.1.*unaffected
  • 6.6.131 to ≤ 6.6.*unaffected
  • 6.12.80 to ≤ 6.12.*unaffected
  • 6.18.21 to ≤ 6.18.*unaffected
  • 6.19.11 to ≤ 6.19.*unaffected
  • 7.0 to ≤ *unaffected

References