Cloudanix VulnDB

CVE-2026-99088

None

CVSS

—

EPSS

0.2%

Published

Oct 26, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A Linux kernel networking component can produce warning messages when handling certain types of fragmented network traffic, but the issue does not let attackers steal data or take over systems.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Theoretical
Impact
Other
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Uninitialized skb transport_header access in update_ipv6_checksum() when Open vSwitch processes IPv6 address rewrite actions on non-first IPv6 fragments, because parse_ipv6hdr() sets NEXTHDR_FRAGMENT and skips skb_set_transport_header().

Why it matters to the business

Triggers spurious kernel warnings in debug builds when handling specific IPv6 fragmented traffic through Open vSwitch, with no data exposure or code execution risk but potential noise in logging and monitoring systems.

How an attack unfolds

An attacker crafts IPv6 fragments that reach set_ipv6_addr() via OVS datapath actions; the missing transport header causes skb_transport_offset() to be evaluated before the NEXTHDR_FRAGMENT check, hitting the debug warning path.

How to fix it

Apply the upstream fix that adds an early return in update_ipv6_checksum() when l4_proto equals NEXTHDR_FRAGMENT; rebuild and deploy the patched kernel.

How to confirm the fix worked

Reproduce the fragment scenario under CONFIG_DEBUG_NET=y and confirm the warning no longer appears; verify the early-return check is present in the updated actions.c source.

Typical attack path

  1. Craft and send IPv6 fragmented packets targeting an OVS bridge
  2. Trigger IPv6 address rewrite action in the datapath
  3. Cause parse_ipv6hdr() to return early for non-first fragment
  4. Invoke update_ipv6_checksum() which reads uninitialized transport offset

How to detect it

Search kernel logs and dmesg for the strings skb_transport_header_was_set, skb_transport_offset, update_ipv6_checksum, and set_ipv6_addr around the time of IPv6 fragment processing.

  • !skb_transport_header_was_set(skb)
  • WARNING: ./include/linux/skbuff.h:3075
  • update_ipv6_checksum net/openvswitch/actions.c:361
  • set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399

What your security team should do

  • Prioritize kernel update for any systems running affected Open vSwitch versions
  • Suppress or filter the specific skb_transport_header warning in debug logging pipelines until patched
  • Test IPv6 fragment handling in staging environments before production rollout

The record

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: validate transport header presence in set_ipv6_addr When executing IPv6 address rewrite actions on IPv6 fragments, set_ipv6_addr() calls update_ipv6_checksum(). If parse_ipv6hdr() processes a non-first IPv6 fragment, it sets key->ip.proto to NEXTHDR_FRAGMENT and returns early without calling skb_set_transport_header(). update_ipv6_checksum() unconditionally evaluates skb_transport_offset() on entry before checking l4_proto. Because skb->transport_header is uninitialized, this triggers a warning under CONFIG_DEBUG_NET=y although it is completely harmless. Fix this by returning early in update_ipv6_checksum() if l4_proto is NEXTHDR_FRAGMENT. This avoids reading the uninitialized transport offset for fragments while preserving the debug warning for any other protocol where the transport header is unexpectedly missing. See the syzbot trace: !skb_transport_header_was_set(skb) WARNING: ./include/linux/skbuff.h:3075 at skb_transport_header include/linux/skbuff.h:3075 [inline], CPU#1: syz-executor463/5635 WARNING: ./include/linux/skbuff.h:3075 at skb_transport_offset include/linux/skbuff.h:3250 [inline], CPU#1: syz-executor463/5635 WARNING: ./include/linux/skbuff.h:3075 at update_ipv6_checksum net/openvswitch/actions.c:361 [inline], CPU#1: syz-executor463/5635 WARNING: ./include/linux/skbuff.h:3075 at set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399, CPU#1: syz-executor463/5635 [...] RIP: 0010:skb_transport_header include/linux/skbuff.h:3075 [inline] RIP: 0010:skb_transport_offset include/linux/skbuff.h:3250 [inline] RIP: 0010:update_ipv6_checksum net/openvswitch/actions.c:361 [inline] RIP: 0010:set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399 [...] Call Trace: <TASK> set_ipv6 net/openvswitch/actions.c:531 [inline] do_execute_actions+0x557e/0x8600 net/openvswitch/actions.c:1366 ovs_execute_actions+0xde/0x520 net/openvswitch/actions.c:1592 ovs_packet_cmd_execute+0xb4f/0xf10 net/openvswitch/datapath.c:705 genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114 genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2572 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218 netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1916 sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800

Affected packages

Ecosystem Package Introduced Fixed