CVE-2026-99088
Received Received - Intake

Openvswitch IPv6 Fragment Checksum Validation Flaw

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: validate transport header presence in set_ipv6_addr When executing IPv6 address rewrite actions on IPv6 fragments, set_ipv6_addr() calls update_ipv6_checksum(). If parse_ipv6hdr() processes a non-first IPv6 fragment, it sets key->ip.proto to NEXTHDR_FRAGMENT and returns early without calling skb_set_transport_header(). update_ipv6_checksum() unconditionally evaluates skb_transport_offset() on entry before checking l4_proto. Because skb->transport_header is uninitialized, this triggers a warning under CONFIG_DEBUG_NET=y although it is completely harmless. Fix this by returning early in update_ipv6_checksum() if l4_proto is NEXTHDR_FRAGMENT. This avoids reading the uninitialized transport offset for fragments while preserving the debug warning for any other protocol where the transport header is unexpectedly missing. See the syzbot trace: !skb_transport_header_was_set(skb) WARNING: ./include/linux/skbuff.h:3075 at skb_transport_header include/linux/skbuff.h:3075 [inline], CPU#1: syz-executor463/5635 WARNING: ./include/linux/skbuff.h:3075 at skb_transport_offset include/linux/skbuff.h:3250 [inline], CPU#1: syz-executor463/5635 WARNING: ./include/linux/skbuff.h:3075 at update_ipv6_checksum net/openvswitch/actions.c:361 [inline], CPU#1: syz-executor463/5635 WARNING: ./include/linux/skbuff.h:3075 at set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399, CPU#1: syz-executor463/5635 [...] RIP: 0010:skb_transport_header include/linux/skbuff.h:3075 [inline] RIP: 0010:skb_transport_offset include/linux/skbuff.h:3250 [inline] RIP: 0010:update_ipv6_checksum net/openvswitch/actions.c:361 [inline] RIP: 0010:set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399 [...] Call Trace: <TASK> set_ipv6 net/openvswitch/actions.c:531 [inline] do_execute_actions+0x557e/0x8600 net/openvswitch/actions.c:1366 ovs_execute_actions+0xde/0x520 net/openvswitch/actions.c:1592 ovs_packet_cmd_execute+0xb4f/0xf10 net/openvswitch/datapath.c:705 genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114 genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2572 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218 netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1916 sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-99088
EUVD
EUVD-2026-109894

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
Linux Linux 3fdbd1ce11e5c0d7cafbe44c942c5cad61113d7b
Linux Linux 3fdbd1ce11e5c0d7cafbe44c942c5cad61113d7b
Linux Linux 3fdbd1ce11e5c0d7cafbe44c942c5cad61113d7b
Linux Linux 3fdbd1ce11e5c0d7cafbe44c942c5cad61113d7b
Linux Linux 3fdbd1ce11e5c0d7cafbe44c942c5cad61113d7b
Linux Linux 3.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the Open vSwitch IPv6 address rewrite functionality. When processing IPv6 fragments, the set_ipv6_addr function calls update_ipv6_checksum which unconditionally checks the transport header offset before validating if the header is set. This leads to a debug warning under CONFIG_DEBUG_NET=y because the transport header is uninitialized for fragments, though it is harmless.

Detection Guidance

This vulnerability is specific to the Linux kernel's Open vSwitch implementation and triggers a debug warning when processing IPv6 fragments. Detection requires checking kernel logs for warnings related to skb_transport_header or update_ipv6_checksum during IPv6 fragment handling. Use commands like dmesg | grep -i 'skb_transport_header' or journalctl -k | grep -i 'update_ipv6_checksum' to search for related warnings.

Impact Analysis

The vulnerability triggers debug warnings in the kernel when IPv6 fragments are processed by Open vSwitch. While not harmful, it may indicate potential issues in network packet handling. Systems using Open vSwitch with IPv6 fragments could see log noise or performance overhead due to these warnings.

Mitigation Strategies

Apply the kernel patch that fixes the issue by ensuring update_ipv6_checksum() returns early for NEXTHDR_FRAGMENT. Update to a patched Linux kernel version. If using Open vSwitch, update to a version containing the fix. Monitor kernel logs for any remaining warnings after applying updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99088. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart