CVE-2026-89555

A flaw was found in the Linux kernel's Multiprotocol Label Switching (MPLS) subsystem. When processing specially crafted Geneve packets through an MPLS multipath setup, a use-after-free vulnerability occurs. This issue arises because a cached header pointer (hdr) is not reloaded after pskb_may_pull() potentially reallocates the packet buffer, leading to hdr pointing to freed memory. A remote attacker could exploit this to trigger a kernel crash, resulting in a denial of service.

An MPLS multipath hash path can dereference a stale MPLS header pointer after pskb_may_pull expands and replaces the skb head. A legal encapsulated packet can place the inner IP header in nonlinear skb data and force pskb_expand_head, leaving the cached hdr pointer referencing freed memory before the IPv4 or IPv6 header is parsed. For the CVSS the PR:N is used because a remote sender does not need privileges on the target when the MPLS multipath and tunnel endpoint are reachable. The issue is network reachable in systems that route or decapsulate traffic into a bareudp/MPLS multipath setup, but it depends on non default MPLS and encapsulation configuration. Impact is at least denial of service via kernel crash. In the paranoid interpretation the use after free read in the network receive path may justify limited confidentiality or integrity impact and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.