CVE-2026-68123

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An off-by-one error exists in the openvswitch module within the queue gso packets() and queue userspace packet() functions. The issue occurs because OVS ACTION ATTR TRUNC stores a delta from the original skb length in OVS CB(skb)->cutlen. When a userspace action segments a Generic Segmentation Offload (GSO) skb, the same delta is reused for each smaller segment. This can result in a segment reaching queue userspace packet() with a cutlen greater than the current skb->len, causing an underflow in the length passed to skb zerocopy(). This flaw may allow a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.