CVE-2025-38146: Linux Kernel MPLS Parsing DOS Vulnerability

CVE-2025-38146 Overview

CVE-2025-38146 is a Linux kernel vulnerability in the Open vSwitch (OVS) subsystem. The flaw resides in the MPLS (Multiprotocol Label Switching) parsing logic within net/openvswitch/flow.c. A malformed MPLS packet without a bottom-of-stack label can wrap the label counter, triggering an infinite loop inside key_extract_l3l4(). The result is a CPU soft lockup and out-of-bounds array access on the __be32 [3] label buffer. The issue affects the Linux kernel and Debian Linux distributions that ship affected kernel builds. The vulnerability is tracked under [CWE-129: Improper Validation of Array Index].

Critical Impact
Local attackers with the ability to send crafted MPLS traffic through an Open vSwitch datapath can induce a kernel soft lockup and denial of service on the host.

Affected Products

Linux Kernel (multiple stable branches prior to fix commits)
Debian Linux 11.0
Systems running Open vSwitch datapath with MPLS processing enabled

Discovery Timeline

2025-07-03 - CVE-2025-38146 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38146

Vulnerability Analysis

The vulnerability exists in the Open vSwitch flow key extraction path. When processing MPLS-encapsulated traffic, the kernel iterates through label stack entries expecting one entry to contain the Bottom-of-Stack (BoS) bit. When the crafted packet omits the BoS marker and contains a large number of labels, the loop counter tracking the label depth wraps around. The negative index is then used to access the fixed __be32 [3] label storage array, producing an out-of-bounds read reported by UBSAN as index -1 is out of range.

Because the loop condition never terminates on a bottom label, the CPU spins inside softirq context. The dump trace shows the loop invoked from netdev_frame_hook through ovs_vport_receive and ovs_flow_key_extract, ultimately hitting key_extract_l3l4. Under sustained malformed traffic, the host generates soft lockup warnings and stops servicing other work on the affected core.

Root Cause

The root cause is missing validation of the MPLS label count against the label stack array bounds. The parser trusts that a BoS bit will terminate the loop and does not bound the number of iterations to the maximum supported label depth. This is an array index validation flaw as defined by [CWE-129].

Attack Vector

Exploitation requires the ability to deliver crafted MPLS frames to an interface attached to an Open vSwitch bridge. On virtualization or container hosts, a local tenant with access to a guest network interface can craft the packet and inject it into the OVS datapath, causing the host CPU to lock up.

No verified proof-of-concept code is publicly available. The vulnerability mechanics are documented in the upstream kernel commits linked in the mitigation section.

Detection Methods for CVE-2025-38146

Indicators of Compromise

Kernel log entries containing UBSAN: array-index-out-of-bounds in ... net/openvswitch/flow.c with index -1 is out of range for type '__be32 [3]'.
soft lockup or CPU stuck warnings referencing key_extract_l3l4, ovs_flow_key_extract, or netdev_frame_hook in stack traces.
Sudden CPU saturation on a single core handling network softirqs on an Open vSwitch host.

Detection Strategies

Ingest dmesg and /var/log/kern.log into a centralized logging platform and alert on the UBSAN and soft lockup signatures above.
Monitor Open vSwitch datapath statistics for unusual MPLS packet volumes or drops on interfaces not expected to carry MPLS traffic.
Correlate host CPU stalls with packet capture on OVS-attached interfaces to identify malformed MPLS label stacks lacking the BoS bit.

Monitoring Recommendations

Track kernel version inventory across Linux and Debian fleets to confirm patched builds are deployed.
Baseline expected MPLS traffic per host; alert when non-MPLS workloads suddenly receive MPLS-tagged frames.
Enable CONFIG_SOFTLOCKUP_DETECTOR and forward watchdog events to your SIEM for early detection of loop conditions.

How to Mitigate CVE-2025-38146

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the fix commits below and reboot affected hosts.
Update Debian 11 systems using the packages announced in the Debian LTS advisory (msg00007) and Debian LTS advisory (msg00008).
Restrict which tenants and interfaces can deliver MPLS-tagged frames to Open vSwitch bridges until patches are installed.

Patch Information

The fix adds bounds checking to the MPLS label parsing loop in net/openvswitch/flow.c so the parser stops at the maximum supported label depth even when the Bottom-of-Stack bit is absent. Stable branch fix commits are available from the kernel.org stable tree (0bdc924b), 3c1906a3, 4b9a086e, 69541e58, 8ebcd311, ad17eb86, and f26fe7c3.

Workarounds

Disable MPLS processing on Open vSwitch bridges that do not require it by removing MPLS match/actions from installed flows.
Apply ingress filtering with tc or nftables to drop MPLS ethertypes (0x8847, 0x8848) on interfaces exposed to untrusted tenants.
Isolate untrusted workloads onto hosts running patched kernels before restoring normal MPLS handling.

bash

# Drop MPLS unicast and multicast frames on an untrusted interface
sudo tc qdisc add dev eth0 ingress
sudo tc filter add dev eth0 ingress protocol 0x8847 u32 match u32 0 0 action drop
sudo tc filter add dev eth0 ingress protocol 0x8848 u32 match u32 0 0 action drop

# Verify installed kernel version after patching
uname -r