CVE-2026-31679

Root

Cause

The Linux kernel's Open vSwitch (openvswitch) module lacked proper validation of the MPLS payload length in validate_set() when processing OVS_KEY_ATTR_MPLS for SET and SET_MASKED actions. The function accepted variable-sized payloads, but the action handling code expects a fixed-size struct ovs_key_mpls. This inconsistency could allow crafted actions with non-matching MPLS key sizes to bypass early checks [1][2].

Exploitation

An attacker with the ability to create or modify OVS flows (e.g., via a local user with certain capabilities, or potentially from a network-accessible OVS management interface) could submit a flow action with an undersized or oversized MPLS key. The missing length check means that such malformed actions would reach the action execution path, where the fixed-size assumption leads to reading beyond the allocated buffer or misinterpreting memory [3][4].

Impact

Successful exploitation may result in an out-of-bounds read or write during MPLS action processing, potentially leading to kernel memory corruption, denial of service, or privilege escalation. The CVSS score of 7.1 (High) reflects the availability and integrity impact, as well as the low attack complexity once an attacker can inject actions [1].

Mitigation

The fix has been merged into the Linux kernel stable tree via commits that reject any MPLS action with a key length not matching sizeof(struct ovs_key_mpls). System administrators should apply the latest stable kernel updates. For systems that cannot be immediately updated, restricting access to OVS flow management can reduce the attack surface [2][3][4].