CVE-2025-38146

What it actually does

The flaw allows an MPLS packet lacking a bottom-of-stack label to trigger label count wraparound during parsing in openvswitch, causing an infinite loop in key_extract_l3l4 that results in soft lockup and CPU stuck conditions.

Why it matters to the business

Systems processing untrusted network traffic via Open vSwitch can experience sudden CPU exhaustion and hangs, leading to loss of network connectivity, service disruption, and potential cascading failures in virtualized or container environments.

How an attack unfolds

An attacker sends a crafted MPLS packet with a large number of labels that causes integer wraparound in the label count; the openvswitch flow extraction code then enters a dead loop while attempting to parse the stack, consuming the CPU and triggering a soft lockup without requiring authentication or special privileges.

How to fix it

Apply the upstream fix in commit 4b9a086eedc1fddae632310386098c12155e3d0a or later stable kernel releases containing the patch; rebuild and deploy the updated kernel on all affected systems, then reboot to load the corrected openvswitch module.

How to confirm the fix worked

Confirm the running kernel contains commit 4b9a086eedc1fddae632310386098c12155e3d0a, verify that UBSAN array-index-out-of-bounds warnings no longer appear for flow.c:662 during MPLS processing, and test with synthetic packets that previously triggered the loop.

Typical attack path

1. Craft an MPLS packet with label stack depth sufficient to cause count wraparound
2. Transmit the packet toward a host or container using Open vSwitch for packet processing
3. Trigger key_extract and key_extract_l3l4 paths during flow key extraction
4. Induce infinite loop resulting in soft lockup and denial of service

How to detect it

Search kernel logs and dmesg for soft lockup reports, UBSAN array-index-out-of-bounds messages referencing flow.c:662, call traces containing key_extract_l3l4 and ovs_flow_key_extract, and repeated CPU stuck warnings on systems running openvswitch; correlate with inbound MPLS packets lacking bottom-of-stack indicators.

• UBSAN: array-index-out-of-bounds in /build/linux-*/net/openvswitch/flow.c:662
• key_extract_l3l4+0x82a/0x840 [openvswitch]
• index -1 is out of range for type '__be32 [3]'
• soft lockup - CPU#
• ovs_vport_receive
• netdev_port_receive

What your security team should do

• Prioritize kernel updates on all systems using Open vSwitch within the next maintenance window given the 481 days since publication
• Monitor for soft lockup messages and openvswitch-related UBSAN reports in system logs
• Restrict MPLS traffic from untrusted sources until patches are applied
• Validate the fix in a staging environment before broad deployment