SB20260928318 - Signed to Unsigned Conversion Error in Linux kernel core

Description

This security bulletin contains information about 1 vulnerability.

1) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-97612)

CWE-ID: CWE-195 - Signed to Unsigned Conversion Error

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to stale inner protocol state in skb_mpls_pop() when Open vSwitch re-pushes MPLS after all labels have been popped and the packet has been recirculated. A local user can trigger MPLS label push, pop, recirculation, and a subsequent label push to cause memory corruption.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/011e17b5cae19b9f6a150923275e41c278de64f0
• https://git.kernel.org/stable/c/78a86d75a70e1e227711c72865c59b1422d0a5ae
• https://git.kernel.org/stable/c/b39120523475d6b436be7f6cb27d48064148a327
• https://git.kernel.org/stable/c/da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e