{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38146", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.988Z", "datePublished": "2025-07-03T08:35:52.230Z", "dateUpdated": "2026-08-05T11:59:52.250Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:59:52.250Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: Fix the dead loop of MPLS parse\n\nThe unexpected MPLS packet may not end with the bottom label stack.\nWhen there are many stacks, The label count value has wrapped around.\nA dead loop occurs, soft lockup/CPU stuck finally.\n\nstack backtrace:\nUBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26\nindex -1 is out of range for type '__be32 [3]'\nCPU: 34 PID: 0 Comm: swapper/34 Kdump: loaded Tainted: G OE 5.15.0-121-generic #131-Ubuntu\nHardware name: Dell Inc. PowerEdge C6420/0JP9TF, BIOS 2.12.2 07/14/2021\nCall Trace:\n \n show_stack+0x52/0x5c\n dump_stack_lvl+0x4a/0x63\n dump_stack+0x10/0x16\n ubsan_epilogue+0x9/0x36\n __ubsan_handle_out_of_bounds.cold+0x44/0x49\n key_extract_l3l4+0x82a/0x840 [openvswitch]\n ? kfree_skbmem+0x52/0xa0\n key_extract+0x9c/0x2b0 [openvswitch]\n ovs_flow_key_extract+0x124/0x350 [openvswitch]\n ovs_vport_receive+0x61/0xd0 [openvswitch]\n ? kernel_init_free_pages.part.0+0x4a/0x70\n ? get_page_from_freelist+0x353/0x540\n netdev_port_receive+0xc4/0x180 [openvswitch]\n ? netdev_port_receive+0x180/0x180 [openvswitch]\n netdev_frame_hook+0x1f/0x40 [openvswitch]\n __netif_receive_skb_core.constprop.0+0x23a/0xf00\n __netif_receive_skb_list_core+0xfa/0x240\n netif_receive_skb_list_internal+0x18e/0x2a0\n napi_complete_done+0x7a/0x1c0\n bnxt_poll+0x155/0x1c0 [bnxt_en]\n __napi_poll+0x30/0x180\n net_rx_action+0x126/0x280\n ? bnxt_msix+0x67/0x80 [bnxt_en]\n handle_softirqs+0xda/0x2d0\n irq_exit_rcu+0x96/0xc0\n common_interrupt+0x8e/0xa0\n " } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H", "baseScore": 9.4, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The parse runs in the OVS receive path before any flow lookup, and OVS tunnel vports (VXLAN/Geneve/GRETAP, created with VXLAN_F_COLLECT_METADATA so any source IP and VNI is accepted) hand their decapsulated inner Ethernet frame to netdev_frame_hook, letting a routed remote attacker deliver the malicious MPLS stack. On plain netdev ports OVS also forces IFF_PROMISC, so any frame reaching the NIC is parsed regardless of destination MAC.\nAC:L - A single ~1 KB Ethernet frame with ethertype 0x8847 and 256 MPLS label-stack entries with S=0 deterministically wraps the u8 counter; there is no race, no memory-layout dependency, and no state the attacker does not control.\nPR:N - The entire path (netdev_frame_hook → ovs_vport_receive → ovs_flow_key_extract → key_extract_l3l4) is a softirq packet handler with no syscall, capability check, or authentication, and key extraction precedes flow lookup so no OVS flow rule need permit the traffic.\nUI:N - The malformed frame is parsed automatically on receipt; no action by any local user or administrator is involved.\nS:U - The lockup and memory-safety violations are confined to the kernel that parses the packet; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The same counter wrap leaves num_labels_mask = GENMASK(-1,0) = 0xffffffff, so hweight_long() yields 32 and __ovs_nla_put_key() reads lse[0..31] — 128 bytes out of a 12-byte array, running ~36 bytes past the stack-resident sw_flow_key plus ~56 bytes of never-initialized union tail — and copies that kernel stack content into the netlink upcall message. This is far beyond a strictly bounded few-byte read.\nI:L - The wrap produces a 4-byte attacker-controlled out-of-bounds write at lse[-1], which lands on the adjacent in-struct num_labels_mask, leaving the flow key claiming 32 MPLS labels and able to drive incorrect flow classification/installation. It is bounded within the object and yields no arbitrary-write or control-flow-hijack primitive.\nA:H - Rewinding the inner network header on the wrap iteration creates an unbounded loop inside net_rx_action/NAPI softirq, permanently wedging that CPU with a soft lockup / CPU stuck (exactly as reported in production on a bnxt_en NIC). Repeating the packet across RX queues can wedge every CPU, requiring a reboot." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/openvswitch/flow.c" ], "versions": [ { "version": "fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3", "lessThan": "4b9a086eedc1fddae632310386098c12155e3d0a", "status": "affected", "versionType": "git" }, { "version": "fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3", "lessThan": "ad17eb86d042d72a59fd184ad1adf34f5eb36843", "status": "affected", "versionType": "git" }, { "version": "fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3", "lessThan": "f26fe7c3002516dd3c288f1012786df31f4d89e0", "status": "affected", "versionType": "git" }, { "version": "fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3", "lessThan": "8ebcd311b4866ab911d1445ead08690e67f0c488", "status": "affected", "versionType": "git" }, { "version": "fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3", "lessThan": "69541e58323ec3e3904e1fa87a6213961b1f52f4", "status": "affected", "versionType": "git" }, { "version": "fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3", "lessThan": "3c1906a3d50cb94fd0a10e97a1c0a40c0f033cb7", "status": "affected", "versionType": "git" }, { "version": "fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3", "lessThan": "0bdc924bfb319fb10d1113cbf091fc26fb7b1f99", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/openvswitch/flow.c" ], "versions": [ { "version": "5.5", "status": "affected" }, { "version": "0", "lessThan": "5.5", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.239", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.186", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.142", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.94", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.34", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.3", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.10.239" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.15.186" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.1.142" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.6.94" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.12.34" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.15.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/4b9a086eedc1fddae632310386098c12155e3d0a" }, { "url": "https://git.kernel.org/stable/c/ad17eb86d042d72a59fd184ad1adf34f5eb36843" }, { "url": "https://git.kernel.org/stable/c/f26fe7c3002516dd3c288f1012786df31f4d89e0" }, { "url": "https://git.kernel.org/stable/c/8ebcd311b4866ab911d1445ead08690e67f0c488" }, { "url": "https://git.kernel.org/stable/c/69541e58323ec3e3904e1fa87a6213961b1f52f4" }, { "url": "https://git.kernel.org/stable/c/3c1906a3d50cb94fd0a10e97a1c0a40c0f033cb7" }, { "url": "https://git.kernel.org/stable/c/0bdc924bfb319fb10d1113cbf091fc26fb7b1f99" } ], "title": "net: openvswitch: Fix the dead loop of MPLS parse", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:34:37.672Z" } } ] } }