CVE-2026-68123: Linux Kernel Openvswitch DoS Vulnerability

CVE-2026-68123 Overview

CVE-2026-68123 is a kernel vulnerability in the Linux Open vSwitch (OVS) subsystem. The flaw affects how OVS_ACTION_ATTR_TRUNC handles Generic Segmentation Offload (GSO) packets destined for userspace. The action stores a truncation delta in OVS_CB(skb)->cutlen relative to the original socket buffer length. When a subsequent userspace action segments a GSO skb, the reused delta can exceed the length of smaller segments, causing an integer underflow in the length passed to skb_zerocopy().

Critical Impact
The underflow triggers out-of-bounds memory access in the kernel networking path, exposing systems with OVS-based networking to remote memory corruption and denial of service.

Affected Products

Linux kernel with Open vSwitch (openvswitch) module enabled
Distributions shipping affected stable kernel branches referenced by the upstream fix commits
Virtualization and container hosts relying on OVS datapaths (for example, OpenStack, KVM, Kubernetes with OVS CNI)

Discovery Timeline

2026-08-10 - CVE-2026-68123 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68123

Vulnerability Analysis

The defect lives in the Open vSwitch datapath action handling for packet truncation. OVS_ACTION_ATTR_TRUNC records a delta representing the number of bytes to strip from the original skb. That delta is stored in OVS_CB(skb)->cutlen and consumed later when the packet is delivered.

When a GSO skb reaches a userspace action, queue_gso_packets() segments it into multiple smaller skbs. Each resulting segment inherits the same cutlen delta computed against the original, larger skb. A segment can then arrive at queue_userspace_packet() with a cutlen value greater than skb->len. The subtraction feeding skb_zerocopy() underflows into a very large unsigned length, causing the copy to walk past valid skb data.

The upstream fix changes the semantic of cutlen from a delta to a maximum preserved length, and bounds each consumer against the current skb length. It uses U32_MAX as a no-truncation sentinel so the stored value remains valid even if skb geometry changes before a consumer processes it.

Root Cause

The root cause is an integer underflow driven by stale state reuse. The truncation delta is computed once against the pre-segmentation skb length, then applied unchanged to post-segmentation skbs whose lengths are smaller than the delta. No bound check compares cutlen against the current skb->len before the arithmetic that feeds skb_zerocopy().

Attack Vector

The vulnerability is reachable over the network on hosts that expose OVS datapaths accepting attacker-influenced traffic. A remote attacker can craft packet flows that traverse an OVS action pipeline combining OVS_ACTION_ATTR_TRUNC with a userspace action on GSO-eligible traffic. Successful exploitation produces kernel memory corruption or crashes in the skb_zerocopy() path.

No verified public exploit code is available. See the upstream fix commits for the exact code paths involved: Kernel Patch Commit 100a23b and Kernel Patch Commit a16eaa.

Detection Methods for CVE-2026-68123

Indicators of Compromise

Kernel oops or panic messages referencing skb_zerocopy, queue_userspace_packet, or queue_gso_packets in dmesg or /var/log/kern.log
Unexpected openvswitch module crashes on hosts handling GSO traffic combined with truncation actions
Repeated segmentation faults or reboots on hypervisors and container hosts using OVS datapaths

Detection Strategies

Inventory kernels running the vulnerable openvswitch code by comparing installed kernel versions against the stable branches carrying the fix commits.
Monitor OVS flow tables for rules combining trunc actions with userspace output actions, which are the exploit precondition.
Correlate kernel crash telemetry with network-facing services on OVS-backed nodes to identify triggered underflows.

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized analytics tier for anomaly detection on OVS-related stack traces.
Track openvswitch datapath statistics (ovs-dpctl show) for unusual drop or error counters on affected hosts.
Alert on new deployments of OVS flow rules that pair truncation with userspace delivery until hosts are patched.

How to Mitigate CVE-2026-68123

Immediate Actions Required

Update the Linux kernel on all OVS-enabled hosts to a version containing the referenced stable fixes.
Restrict which processes can install OVS flows by tightening access to ovs-vsctl and the OVSDB management socket.
Audit existing OVS flow tables and remove any rules combining OVS_ACTION_ATTR_TRUNC with userspace actions until patched kernels are deployed.

Patch Information

Upstream fixes are available in the following stable commits: Kernel Patch Commit 100a23b, Kernel Patch Commit 4032f8e, Kernel Patch Commit a16eaa, Kernel Patch Commit ea85dbc, and Kernel Patch Commit fbfa3ad. Apply the distribution-provided kernel update that incorporates these commits and reboot affected hosts.

Workarounds

Disable OVS flow rules that use trunc in combination with userspace output actions where operationally feasible.
Disable Generic Segmentation Offload on interfaces attached to OVS bridges using ethtool -K <iface> gso off if patching must be delayed.
Isolate OVS-backed hosts from untrusted network segments until the fixed kernel is deployed.

bash

# Verify running kernel and disable GSO on an OVS-attached interface as a temporary workaround
uname -r
sudo ethtool -K eth0 gso off
sudo ovs-ofctl dump-flows br-int | grep -E 'trunc|userspace'