CVE-2026-97612

A flaw was found in the Linux kernel's Multiprotocol Label Switching (MPLS) networking subsystem. When all labels are removed from an encapsulated packet, the kernel fails to clear internal protocol tracking metadata, leaving stale network header references. An attacker could exploit this flaw by sending network traffic processed by affected routing environments such as Open vSwitch, causing an out-of-bounds memory copy. This failure triggers a kernel crash, resulting in a Denial of Service (DoS).

A stale MPLS inner network header can survive after the last MPLS label is popped. Open vSwitch can later reuse this stale header after MPLS recirculation and fragmentation, causing a negative network offset to pass a signed bounds check. The negative value is converted to an unsigned length and used by memcpy in prepare_frag, resulting in a massive kernel out of bounds write. For the CVSS the PR:L because reliable triggering requires control of Open vSwitch flow configuration or equivalent delegated network administration capabilities. The issue is not directly network reachable through packet traffic alone, although a remote peer may supply packets after a privileged actor has installed a vulnerable MPLS flow configuration. Impact includes kernel crash and may include confidentiality integrity and privilege escalation consequences because the patch context demonstrates an out of bounds kernel write.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.