{"id":"CVE-2026-68123","revision":"625cc8e0f9104fe395fe5ad5669f154e","records":[{"revision":"625cc8e0f9104fe395fe5ad5669f154e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-68123","aliases":[],"title":"openvswitch: fix GSO userspace truncation underflow","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: fix GSO userspace truncation underflow\n\nOVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb\nlength in OVS_CB(skb)->cutlen. When a later userspace action segments a\nGSO skb, queue_gso_packets() reuses that delta for each smaller segment.\nA segment can then reach queue_userspace_packet() with cutlen greater\nthan skb->len, underflowing the length passed to skb_zerocopy().\n\nStore the maximum preserved length instead and bound each consumer\nagainst the current skb length. Use U32_MAX as the no-truncation\nsentinel so the value remains valid if skb geometry changes before a\nconsumer handles it.","state":0,"publishedAt":"2026-08-10T11:58:43.727+00:00","modifiedAt":"2026-10-19T20:58:51.936+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/openvswitch/actions.c\",\n                        \"net/openvswitch/datapath.c\",\n                        \"net/openvswitch/datapath.h\",\n                        \"net/openvswitch/vport.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1\",\n                            \"lessThan\": \"50a6a85f3d6b1d22d8436848606cdef5d2c490b4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1\",\n                            \"lessThan\": \"2623c48cc3a8da9a1886fd8f65c0e348f4406fd6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1\",\n                            \"lessThan\": \"e211b081901ffca76674082c73eeaed53524c369\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1\",\n                            \"lessThan\": \"a16eaaf7c0b0ccdef6166707d90ffbc6eebf6855\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1\",\n                            \"lessThan\": \"fbfa3ad2ad6f3a5624aba5211c46290fb98cc9dc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1\",\n                            \"lessThan\": \"100a23b1613e9218e0af654ef102352c713f0263\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1\",\n                            \"lessThan\": \"ea85dbcbe8d4056ecb54352f97743d138ea4c407\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1\",\n                            \"lessThan\": \"4032f8ed10fcb84d41c508dfb04be96589f78dfe\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/openvswitch/actions.c\",\n                        \"net/openvswitch/datapath.c\",\n                        \"net/openvswitch/datapath.h\",\n                        \"net/openvswitch/vport.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.265\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.216\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.183\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.148\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.101\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.42\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.6\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/50a6a85f3d6b1d22d8436848606cdef5d2c490b4","https://git.kernel.org/stable/c/2623c48cc3a8da9a1886fd8f65c0e348f4406fd6","https://git.kernel.org/stable/c/e211b081901ffca76674082c73eeaed53524c369","https://git.kernel.org/stable/c/a16eaaf7c0b0ccdef6166707d90ffbc6eebf6855","https://git.kernel.org/stable/c/fbfa3ad2ad6f3a5624aba5211c46290fb98cc9dc","https://git.kernel.org/stable/c/100a23b1613e9218e0af654ef102352c713f0263","https://git.kernel.org/stable/c/ea85dbcbe8d4056ecb54352f97743d138ea4c407","https://git.kernel.org/stable/c/4032f8ed10fcb84d41c508dfb04be96589f78dfe"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68123","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-68123","identifiers":["CVE-2026-68123"]},"retained":false,"historicalAffected":[]}],"coverage":[]}