In the Linux kernel, the following vulnerability has been resolved:

openvswitch: fix GSO userspace truncation underflow

OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb
length in OVS_CB(skb)->cutlen. When a later userspace action segments a
GSO skb, queue_gso_packets() reuses that delta for each smaller segment.
A segment can then reach queue_userspace_packet() with cutlen greater
than skb->len, underflowing the length passed to skb_zerocopy().

Store the maximum preserved length instead and bound each consumer
against the current skb length. Use U32_MAX as the no-truncation
sentinel so the value remains valid if skb geometry changes before a
consumer handles it.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 affected < a16eaaf7c0b0ccdef6166707d90ffbc6eebf6855
f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 affected < fbfa3ad2ad6f3a5624aba5211c46290fb98cc9dc
f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 affected < 100a23b1613e9218e0af654ef102352c713f0263
f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 affected < ea85dbcbe8d4056ecb54352f97743d138ea4c407
f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 affected < 4032f8ed10fcb84d41c508dfb04be96589f78dfe
Linux Linux affected
Version Status Constraints
4.8 affected —
0 unaffected < 4.8
6.6.148 unaffected ≤ 6.6.*
6.12.101 unaffected ≤ 6.12.*
6.18.42 unaffected ≤ 6.18.*
7.1.6 unaffected ≤ 7.1.*
7.2-rc5 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/100a23b1613e9218e0af654ef102352c713f0263 cve-icon
https://git.kernel.org/stable/c/4032f8ed10fcb84d41c508dfb04be96589f78dfe cve-icon
https://git.kernel.org/stable/c/a16eaaf7c0b0ccdef6166707d90ffbc6eebf6855 cve-icon
https://git.kernel.org/stable/c/ea85dbcbe8d4056ecb54352f97743d138ea4c407 cve-icon
https://git.kernel.org/stable/c/fbfa3ad2ad6f3a5624aba5211c46290fb98cc9dc cve-icon
History

Mon, 10 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-193

Mon, 10 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb length in OVS_CB(skb)->cutlen. When a later userspace action segments a GSO skb, queue_gso_packets() reuses that delta for each smaller segment. A segment can then reach queue_userspace_packet() with cutlen greater than skb->len, underflowing the length passed to skb_zerocopy(). Store the maximum preserved length instead and bound each consumer against the current skb length. Use U32_MAX as the no-truncation sentinel so the value remains valid if skb geometry changes before a consumer handles it.
Title openvswitch: fix GSO userspace truncation underflow
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-10T11:58:43.727Z

Reserved: 2026-07-30T09:28:09.369Z

Link: CVE-2026-68123

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T13:45:03Z

Weaknesses