CVE-2026-99088— net: openvswitch: validate transport header presence in set_ipv6_addr
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，以下漏洞已得到修复： net: openvswitch: 在 set_ipv6_addr 中验证传输层头部是否存在 当对 IPv6 分片执行 IPv6 地址重写操作时， 会调用 。如果 处理的是非首个 IPv6 分片，它会将 设置为 ，并提前返回，从而不会调用 。 在进入时，会在检查 之前无条件地评估 。由于此时 尚未初始化，这在开启 配置时会触发一个警告，尽管该问题完全无害。 修复方法是：在 中，如果 为 ，则提前返回。这样可以避免读取分片包中未初始化的传输层偏移量，同时保留对其他协议中意
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-99088
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
net: openvswitch: validate transport header presence in set_ipv6_addr
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: validate transport header presence in set_ipv6_addr
When executing IPv6 address rewrite actions on IPv6 fragments,
set_ipv6_addr() calls update_ipv6_checksum(). If parse_ipv6hdr()
processes a non-first IPv6 fragment, it sets key->ip.proto to
NEXTHDR_FRAGMENT and returns early without calling
skb_set_transport_header().
update_ipv6_checksum() unconditionally evaluates skb_transport_offset()
on entry before checking l4_proto. Because skb->transport_header is
uninitialized, this triggers a warning under CONFIG_DEBUG_NET=y although
it is completely harmless.
Fix this by returning early in update_ipv6_checksum() if l4_proto is
NEXTHDR_FRAGMENT. This avoids reading the uninitialized transport offset
for fragments while preserving the debug warning for any other protocol
where the transport header is unexpectedly missing.
See the syzbot trace:
!skb_transport_header_was_set(skb)
WARNING: ./include/linux/skbuff.h:3075 at skb_transport_header include/linux/skbuff.h:3075 [inline], CPU#1: syz-executor463/5635
WARNING: ./include/linux/skbuff.h:3075 at skb_transport_offset include/linux/skbuff.h:3250 [inline], CPU#1: syz-executor463/5635
WARNING: ./include/linux/skbuff.h:3075 at update_ipv6_checksum net/openvswitch/actions.c:361 [inline], CPU#1: syz-executor463/5635
WARNING: ./include/linux/skbuff.h:3075 at set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399, CPU#1: syz-executor463/5635
[...]
RIP: 0010:skb_transport_header include/linux/skbuff.h:3075 [inline]
RIP: 0010:skb_transport_offset include/linux/skbuff.h:3250 [inline]
RIP: 0010:update_ipv6_checksum net/openvswitch/actions.c:361 [inline]
RIP: 0010:set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399
[...]
Call Trace:
<TASK>
set_ipv6 net/openvswitch/actions.c:531 [inline]
do_execute_actions+0x557e/0x8600 net/openvswitch/actions.c:1366
ovs_execute_actions+0xde/0x520 net/openvswitch/actions.c:1592
ovs_packet_cmd_execute+0xb4f/0xf10 net/openvswitch/datapath.c:705
genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114
genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2572
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1916
sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-99088
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-99088
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-99088 (5)
Same Patch Batch · Linux · 2026-10-26 · 12 CVEs total
| CVE-2026-99099 | x86/CPU/AMD: Fix AMD TLBI Erratum #1718 | |
| CVE-2026-99097 | tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper() | |
| CVE-2026-99098 | dm-integrity: fix buffer overflow in inline mode with large tag size | |
| CVE-2026-99095 | drm/vc4: drain the hangcheck timer and works on V3D unbind | |
| CVE-2026-99096 | io_uring/register: don't exempt disabled rings from task restrictions | |
| CVE-2026-99094 | Bluetooth: btintel_pcie: fix TX descriptor bounds check | |
| CVE-2026-99093 | mm: don't schedule deferred kernel page table freeing while booting | |
| CVE-2026-99092 | riscv: patch: fix handling of bpf-jit execmem addresses | |
| CVE-2026-99090 | drm/amdgpu: serialize vblank counter reads against GPU reset | |
| CVE-2026-99091 | Bluetooth: MGMT: Fix status of pending commands flushed on power off | |
| CVE-2026-99089 | ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM |
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-99099
x86/CPU/AMD: Fix AMD TLBI Erratum #1718 -
CVE-2026-99097
tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc -
CVE-2026-99098
dm-integrity: fix buffer overflow in inline mode with large -
CVE-2026-99095
drm/vc4: drain the hangcheck timer and works on V3D unbind -
CVE-2026-99096
io_uring/register: don't exempt disabled rings from task res
Same vendor: Linux
-
CVE-2026-99099
x86/CPU/AMD: Fix AMD TLBI Erratum #1718 -
CVE-2026-99097
tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc -
CVE-2026-99098
dm-integrity: fix buffer overflow in inline mode with large -
CVE-2026-99095
drm/vc4: drain the hangcheck timer and works on V3D unbind -
CVE-2026-99096
io_uring/register: don't exempt disabled rings from task res