CVE-2026-99088

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: validate transport header presence in set ipv6 addr

When executing IPv6 address rewrite actions on IPv6 fragments, set ipv6 addr() calls update ipv6 checksum(). If parse ipv6hdr() processes a non-first IPv6 fragment, it sets key->ip.proto to NEXTHDR FRAGMENT and returns early without calling skb set transport header().

update ipv6 checksum() unconditionally evaluates skb transport offset() on entry before checking l4 proto. Because skb->transport header is uninitialized, this triggers a warning under CONFIG DEBUG NET=y although it is completely harmless.

Fix this by returning early in update ipv6 checksum() if l4 proto is NEXTHDR FRAGMENT. This avoids reading the uninitialized transport offset for fragments while preserving the debug warning for any other protocol where the transport header is unexpectedly missing.

See the syzbot trace:

!skb transport header was set(skb) WARNING: ./include/linux/skbuff.h:3075 at skb transport header include/linux/skbuff.h:3075 [inline], CPU#1: syz-executor463/5635 WARNING: ./include/linux/skbuff.h:3075 at skb transport offset include/linux/skbuff.h:3250 [inline], CPU#1: syz-executor463/5635 WARNING: ./include/linux/skbuff.h:3075 at update ipv6 checksum net/openvswitch/actions.c:361 [inline], CPU#1: syz-executor463/5635 WARNING: ./include/linux/skbuff.h:3075 at set ipv6 addr+0x462/0x660 net/openvswitch/actions.c:399, CPU#1: syz-executor463/5635 [...] RIP: 0010:skb transport header include/linux/skbuff.h:3075 [inline] RIP: 0010:skb transport offset include/linux/skbuff.h:3250 [inline] RIP: 0010:update ipv6 checksum net/openvswitch/actions.c:361 [inline] RIP: 0010:set ipv6 addr+0x462/0x660 net/openvswitch/actions.c:399 [...] Call Trace: set ipv6 net/openvswitch/actions.c:531 [inline] do execute actions+0x557e/0x8600 net/openvswitch/actions.c:1366 ovs execute actions+0xde/0x520 net/openvswitch/actions.c:1592 ovs packet cmd execute+0xb4f/0xf10 net/openvswitch/datapath.c:705 genl family rcv msg doit+0x233/0x340 net/netlink/genetlink.c:1114 genl rcv msg+0x614/0x7a0 net/netlink/genetlink.c:1209 netlink rcv skb+0x226/0x4a0 net/netlink/af netlink.c:2572 genl rcv+0x28/0x40 net/netlink/genetlink.c:1218 netlink unicast+0x7bd/0x940 net/netlink/af netlink.c:1361 netlink sendmsg+0x813/0xb40 net/netlink/af netlink.c:1916 sock sendmsg nosec+0x14e/0x190 net/socket.c:800