CVE-2025-38146

A flaw was found in the Linux kernel's Open vSwitch (OVS) component. A remote attacker could send a specially crafted Multiprotocol Label Switching (MPLS) packet that does not properly terminate its label stack. This can cause an array-index-out-of-bounds error and an infinite loop during packet parsing, leading to a system soft lockup or CPU stuck, resulting in a Denial of Service (DoS).

A flaw was found in the Linux kernel's Open vSwitch (OVS) module, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10, and Red Hat rates it as having Moderate security impact. The flaw is triggered when OVS parses a specially crafted Multiprotocol Label Switching (MPLS) packet whose label stack does not end with a bottom-of-stack label; with a sufficiently deep label stack the label count value wraps around, causing an array-index-out-of-bounds access and an infinite loop during flow key extraction in net/openvswitch/flow.c. The parsing loop never terminates, producing a CPU soft lockup on the affected host and a resulting denial of service. An attacker who can deliver such crafted MPLS packets to a system that performs OVS packet processing can stall that system's CPU. Red Hat Enterprise Linux 6 and 7 and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those products. For the affected RHEL 8, 9, and 10 kernel and kernel-rt streams, Red Hat has deferred the fix: the flaw is rated Moderate with availability-only impact (no confidentiality or integrity impact), so it will be addressed in a future update rather than an immediate erratum, and the residual risk until then is that a crafted MPLS packet can soft-lock a CPU on OVS-enabled hosts. Red Hat's CVSS score of 6.1 (AV:L/AC:L/PR:L) is lower than the NIST score of 7.8 and the CVE.org score of 9.4 (AV:N/AC:L/PR:N); the difference reflects divergent assessments of the attack vector and the privileges required to send crafted MPLS packets to an OVS instance.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.