{"id":"CVE-2025-38146","revision":"88f1d4f307bf446eb0cc2a140df3995d","records":[{"revision":"88f1d4f307bf446eb0cc2a140df3995d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-38146","aliases":[],"title":"net: openvswitch: Fix the dead loop of MPLS parse","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: Fix the dead loop of MPLS parse\n\nThe unexpected MPLS packet may not end with the bottom label stack.\nWhen there are many stacks, The label count value has wrapped around.\nA dead loop occurs, soft lockup/CPU stuck finally.\n\nstack backtrace:\nUBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26\nindex -1 is out of range for type '__be32 [3]'\nCPU: 34 PID: 0 Comm: swapper/34 Kdump: loaded Tainted: G OE 5.15.0-121-generic #131-Ubuntu\nHardware name: Dell Inc. PowerEdge C6420/0JP9TF, BIOS 2.12.2 07/14/2021\nCall Trace:\n \n show_stack+0x52/0x5c\n dump_stack_lvl+0x4a/0x63\n dump_stack+0x10/0x16\n ubsan_epilogue+0x9/0x36\n __ubsan_handle_out_of_bounds.cold+0x44/0x49\n key_extract_l3l4+0x82a/0x840 [openvswitch]\n ? kfree_skbmem+0x52/0xa0\n key_extract+0x9c/0x2b0 [openvswitch]\n ovs_flow_key_extract+0x124/0x350 [openvswitch]\n ovs_vport_receive+0x61/0xd0 [openvswitch]\n ? kernel_init_free_pages.part.0+0x4a/0x70\n ? get_page_from_freelist+0x353/0x540\n netdev_port_receive+0xc4/0x180 [openvswitch]\n ? netdev_port_receive+0x180/0x180 [openvswitch]\n netdev_frame_hook+0x1f/0x40 [openvswitch]\n __netif_receive_skb_core.constprop.0+0x23a/0xf00\n __netif_receive_skb_list_core+0xfa/0x240\n netif_receive_skb_list_internal+0x18e/0x2a0\n napi_complete_done+0x7a/0x1c0\n bnxt_poll+0x155/0x1c0 [bnxt_en]\n __napi_poll+0x30/0x180\n net_rx_action+0x126/0x280\n ? bnxt_msix+0x67/0x80 [bnxt_en]\n handle_softirqs+0xda/0x2d0\n irq_exit_rcu+0x96/0xc0\n common_interrupt+0x8e/0xa0\n ","state":0,"publishedAt":"2025-07-03T08:35:52.23+00:00","modifiedAt":"2026-10-15T21:52:09.59+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/openvswitch/flow.c\"\n ],\n \"versions\": [\n {\n \"version\": \"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3\",\n \"lessThan\": \"4b9a086eedc1fddae632310386098c12155e3d0a\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3\",\n \"lessThan\": \"ad17eb86d042d72a59fd184ad1adf34f5eb36843\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3\",\n \"lessThan\": \"f26fe7c3002516dd3c288f1012786df31f4d89e0\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3\",\n \"lessThan\": \"8ebcd311b4866ab911d1445ead08690e67f0c488\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3\",\n \"lessThan\": \"69541e58323ec3e3904e1fa87a6213961b1f52f4\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3\",\n \"lessThan\": \"3c1906a3d50cb94fd0a10e97a1c0a40c0f033cb7\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3\",\n \"lessThan\": \"0bdc924bfb319fb10d1113cbf091fc26fb7b1f99\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/openvswitch/flow.c\"\n ],\n \"versions\": [\n {\n \"version\": \"5.5\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"5.5\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.239\",\n \"lessThanOrEqual\": \"5.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.186\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.142\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.94\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.34\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.15.3\",\n \"lessThanOrEqual\": \"6.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.16\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","score":9.4,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/4b9a086eedc1fddae632310386098c12155e3d0a","https://git.kernel.org/stable/c/ad17eb86d042d72a59fd184ad1adf34f5eb36843","https://git.kernel.org/stable/c/f26fe7c3002516dd3c288f1012786df31f4d89e0","https://git.kernel.org/stable/c/8ebcd311b4866ab911d1445ead08690e67f0c488","https://git.kernel.org/stable/c/69541e58323ec3e3904e1fa87a6213961b1f52f4","https://git.kernel.org/stable/c/3c1906a3d50cb94fd0a10e97a1c0a40c0f033cb7","https://git.kernel.org/stable/c/0bdc924bfb319fb10d1113cbf091fc26fb7b1f99"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38146","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-38146","identifiers":["CVE-2025-38146"]},"retained":false,"historicalAffected":[]}],"coverage":[]}