In the Linux kernel, the following vulnerability has been resolved:
net/openvswitch: check Ethernet header length in key_extract()
When a packet arrives on an ARPHRD_NONE device (e.g. TUN), ovs_flow_key_extract() trusts the user-provided skb->protocol field: if it is ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and key_extract() is called without ensuring the skb has ETH_HLEN (14) bytes of linear data. key_extract() unconditionally pulls 2 * ETH_ALEN bytes for MAC addresses and parse_ethertype() pulls 2 more, either of which triggers a kernel BUG in __skb_pull() when the linear area is too small.
kernel BUG at include/linux/skbuff.h:2848! RIP: 0010:key_extract+0xa7e/0xd90 net/openvswitch/flow.c:933 ovs_flow_key_extract+0x419/0xa70 ovs_vport_receive+0x222/0x390 netdev_frame_hook+0x3e0/0x630 tun_get_user+0x2d0c/0x38e0
Fixed by calling check_header() in key_extract() before accessing the Ethernet header.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.18-develUpgrade kernel6.18-tools-develUpgrade kernel-livepatch-6.18.48-107.148Upgrade kernel6.18-debuginfoUpgrade perf6.18Upgrade bpftool6.18-debuginfoUpgrade bpftool6.18Upgrade python3-perf6.18Upgrade kernel6.18-tools-debuginfoUpgrade kernel6.18-debuginfo-common-x86_64Upgrade python3-perf6.18-debuginfoUpgrade microvm-kernel6.18Upgrade kernel6.18-toolsUpgrade kernel6.18-modules-extra-commonUpgrade kernel6.18-headersUpgrade kernel6.18-modules-extraUpgrade perf6.18-debuginfoUpgrade kernel6.18Upgrade kernel6.18-debuginfo-common-aarch64 | Sep 30, 2026 | Aug 22, 2026 |
| Debian | — | Upgrade linuxUpgrade linux-6.12 | Aug 26, 2026 | Aug 26, 2026 |
| Redhat_linux | — | No solution exists | Aug 26, 2026 | Aug 22, 2026 |
| Ubuntu | — | Upgrade linux-image-lowlatency-64kUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-198-genericUpgrade linux-image-azure-fips-5.15Upgrade linux-image-generic-lpae-5.15Upgrade linux-image-5.15.0-1080-xilinx-zynqmpUpgrade linux-image-5.15.0-1114-oracleUpgrade linux-image-aws-5.15Upgrade linux-image-virtual-5.15Upgrade linux-image-gkeUpgrade linux-image-fips-5.15Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-lowlatency-5.15Upgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-oem-20.04Upgrade linux-image-gkeopUpgrade linux-image-oem-20.04cUpgrade linux-image-5.15.0-1116-realtimeUpgrade linux-image-gkeop-5.15Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-virtualUpgrade linux-image-5.15.0-198-generic-lpaeUpgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-gcpUpgrade linux-image-genericUpgrade linux-image-kvm-5.15Upgrade linux-image-5.15.0-1109-kvmUpgrade linux-image-intelUpgrade linux-image-oem-20.04dUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1118-gcp-fipsUpgrade linux-image-5.15.0-195-lowlatency-64kUpgrade linux-image-realtimeUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-intel-iotg-5.15Upgrade linux-image-5.15.0-1117-aws-64kUpgrade linux-image-oracleUpgrade linux-image-5.15.0-1100-gkeopUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-1123-azureUpgrade linux-image-azure-cvmUpgrade linux-image-azure-lts-22.04Upgrade linux-image-gcp-5.15Upgrade linux-image-realtime-5.15Upgrade linux-image-5.15.0-1109-intel-iot-realtimeUpgrade linux-image-azureUpgrade linux-image-aws-fips-5.15Upgrade linux-image-awsUpgrade linux-image-5.15.0-1113-gkeUpgrade linux-image-azure-fipsUpgrade linux-image-oracle-5.15Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-1118-gcpUpgrade linux-image-5.15.0-1117-awsUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-198-fipsUpgrade linux-image-5.15.0-1112-intel-iotgUpgrade linux-image-5.15.0-1111-ibmUpgrade linux-image-gke-5.15Upgrade linux-image-aws-fipsUpgrade linux-image-oem-20.04bUpgrade linux-image-azure-fde-5.15Upgrade linux-image-5.15.0-195-lowlatencyUpgrade linux-image-5.15.0-1117-aws-fipsUpgrade linux-image-generic-5.15Upgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-5.15.0-1122-azure-fdeUpgrade linux-image-generic-64k-5.15Upgrade linux-image-fipsUpgrade linux-image-aws-64k-5.15Upgrade linux-image-gcp-fipsUpgrade linux-image-ibm-5.15Upgrade linux-image-generic-64kUpgrade linux-image-gcp-fips-5.15Upgrade linux-image-azure-5.15Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-1123-azure-fipsUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-ibmUpgrade linux-image-5.15.0-198-generic-64kUpgrade linux-image-lowlatencyUpgrade linux-image-kvm | Oct 6, 2026 | Oct 6, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 15, 2026 | Aug 22, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub