CVE-2026-68123

A flaw was found in the Open vSwitch component of the Linux kernel. This vulnerability arises from an underflow condition when handling Generic Segmentation Offload (GSO) packets in userspace. A length calculation error can lead to a buffer underflow when data is processed by the skb_zerocopy() function. This issue could result in memory corruption, potentially leading to a denial of service or other unpredictable system behavior.

The Linux kernel packages (kernel and kernel-rt) shipped in Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and other Red Hat products that reuse the kernel are affected by this IMPORTANT severity flaw in the Open vSwitch datapath code. When an Open vSwitch flow applies the packet truncation action (OVS_ACTION_ATTR_TRUNC) to a packet that is later segmented for a Generic Segmentation Offload (GSO) userspace action, the kernel reuses a truncation delta computed against the original, larger packet for each smaller segment. A segment can then reach queue_userspace_packet() with a truncation length greater than the segment length, and the underflowed length passed to skb_zerocopy() causes an out-of-bounds access and kernel memory corruption. The likely consequences are a kernel crash, denial of service, or other unpredictable system behavior. Exploitation requires local access and the ability to trigger the affected Open vSwitch userspace action path under specific, complex conditions, which is reflected in the Red Hat rating of 7.0 IMPORTANT (CVSS 3.1: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). This differs from the upstream CVE record, which assigns 9.8 CRITICAL using a network attack vector; Red Hat rates the flaw lower because the verified attack path is local and requires high attack complexity and privileges rather than unauthenticated remote exploitation. A fix is being pursued for the affected Red Hat product streams. The Red Hat Enterprise Linux for NVIDIA kernel is not affected because the vulnerable code is not present in that build.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.