CVE-2026-68123

CriticalCVSS 9.8

Published: 10/08/2026(UTC)Updated: 13/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

In the Linux kernel openvswitch module, during GSO segmentation for userspace actions, a length underflow can occur, leading to incorrect skb_zerocopy() behavior. The fix stores the maximum preserved length and bounds consumers.

Risk Assessment

This can lead to kernel crashes or incorrect packet processing, affecting the stability and security of virtual switches.

Recommendation

Install the Linux kernel update with the fix for CVE-2026-68123. Monitor Open vSwitch configurations and restrict management access.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb length in OVS_CB(skb)->cutlen. When a later userspace action segments a GSO skb, queue_gso_packets() reuses that delta for each smaller segment. A segment can then reach queue_userspace_packet() with cutlen greater than skb->len, underflowing the length passed to skb_zerocopy(). Store the maximum preserved length instead and bound each consumer against the current skb length. Use U32_MAX as the no-truncation sentinel so the value remains valid if skb geometry changes before a consumer handles it.