{"id":"CVE-2026-99088","kind":"vulnerability","aliases":["CVE-2026-99088"],"related":[],"title":"Linux kernel: Open vSwitch IPv6 fragment rewrite triggers a debug-only warning","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: validate transport header presence in set_ipv6_addr\n\nWhen executing IPv6 address rewrite actions on IPv6 fragments,\nset_ipv6_addr() calls update_ipv6_checksum(). If parse_ipv6hdr()\nprocesses a non-first IPv6 fragment, it sets key->ip.proto to\nNEXTHDR_FRAGMENT and returns early without calling\nskb_set_transport_header().\n\nupdate_ipv6_checksum() unconditionally evaluates skb_transport_offset()\non entry before checking l4_proto.  Because skb->transport_header is\nuninitialized, this triggers a warning under CONFIG_DEBUG_NET=y although\nit is completely harmless.\n\nFix this by returning early in update_ipv6_checksum() if l4_proto is\nNEXTHDR_FRAGMENT. This avoids reading the uninitialized transport offset\nfor fragments while preserving the debug warning for any other protocol\nwhere the transport header is unexpectedly missing.\n\nSee the syzbot trace:\n\n!skb_transport_header_was_set(skb)\nWARNING: ./include/linux/skbuff.h:3075 at skb_transport_header include/linux/skbuff.h:3075 [inline], CPU#1: syz-executor463/5635\nWARNING: ./include/linux/skbuff.h:3075 at skb_transport_offset include/linux/skbuff.h:3250 [inline], CPU#1: syz-executor463/5635\nWARNING: ./include/linux/skbuff.h:3075 at update_ipv6_checksum net/openvswitch/actions.c:361 [inline], CPU#1: syz-executor463/5635\nWARNING: ./include/linux/skbuff.h:3075 at set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399, CPU#1: syz-executor463/5635\n[...]\nRIP: 0010:skb_transport_header include/linux/skbuff.h:3075 [inline]\nRIP: 0010:skb_transport_offset include/linux/skbuff.h:3250 [inline]\nRIP: 0010:update_ipv6_checksum net/openvswitch/actions.c:361 [inline]\nRIP: 0010:set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399\n[...]\nCall Trace:\n <TASK>\n set_ipv6 net/openvswitch/actions.c:531 [inline]\n do_execute_actions+0x557e/0x8600 net/openvswitch/actions.c:1366\n ovs_execute_actions+0xde/0x520 net/openvswitch/actions.c:1592\n ovs_packet_cmd_execute+0xb4f/0xf10 net/openvswitch/datapath.c:705\n genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114\n genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209\n netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2572\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218\n netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361\n netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1916\n sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800","summary":"In the Linux kernel's Open vSwitch code, rewriting IPv6 addresses on non-first IPv6 fragments reads an uninitialized transport header offset. The sources describe this as a harmless warning that appears only with CONFIG_DEBUG_NET enabled, and the fix returns early for fragments.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","ipv6","linux-kernel","open-vswitch"],"not_affected_if":["default-config"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-26T15:16:47+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","triaged_at":"2026-10-26T16:04:12+00:00","updated_at":"2026-10-26T16:04:12+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T16:04:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Linux kernel: Open vSwitch IPv6 fragment rewrite triggers a debug-only warning","impact":"low","summary":"In the Linux kernel's Open vSwitch code, rewriting IPv6 addresses on non-first IPv6 fragments reads an uninitialized transport header offset. The sources describe this as a harmless warning that appears only with CONFIG_DEBUG_NET enabled, and the fix returns early for fragments.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","open-vswitch","ipv6"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; sources describe a harmless debug warning","analyst_note":"Check the NVD entry and the upstream kernel commit for the fixed kernel versions and any stated security impact beyond the debug warning.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Systems running a Linux kernel with Open vSwitch and IPv6 address rewrite actions on fragmented traffic. The sources describe the warning as appearing under CONFIG_DEBUG_NET=y; kernels built without it are not described as affected. Teams using stock distribution kernels should check their vendor's advisory for the patched kernel version.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000696,"input_tokens":4435,"output_tokens":504,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':275C,314C,328C,335C,343C,352C,359C,366C,372C,378C,384C,391C '-2026':15A,18A '-99088':16A,19A '/5635':235C,251C,267C,284C '/include/linux/skbuff.h':221C,237C,253C,269C '0010':286C,294C,302C,310C '1':231C,247C,263C,280C '1114':355C '1209':362C '1218':375C '1361':381C '1366':331C '1592':338C '1916':387C '2572':369C '3075':222C,228C,238C,254C,270C,291C '3250':244C,299C '361':260C,307C '399':278C,317C '531':323C '705':346C '800':394C 'action':99C,327C,334C 'addr':93C,105C,274C,313C 'address':38B,97C 'although':165C 'appear':60B 'avoid':186C 'call':106C,131C,318C 'check':147C 'checksum':109C,138C,178C,258C,305C 'cmd':341C 'code':35B 'complet':168C 'config':63B,161C 'cpu':230C,246C,262C,279C 'cve':14A,17A 'debug':11A,64B,162C,197C 'debug-on':10A 'describ':53B 'doit':351C 'earli':71B,129C,174C 'enabl':66B 'entri':145C 'evalu':140C 'execut':95C,326C,333C,342C 'executor463':234C,250C,266C,283C 'famili':348C 'first':42B,117C 'fix':69B,170C 'follow':79C 'fragment':6A,44B,73B,102C,119C,126C,184C,193C 'genl':347C,356C,370C 'harmless':57B,169C 'header':49B,88C,135C,153C,206C,216C,226C,289C 'include/linux/skbuff.h':227C,243C,290C,298C 'infrastructur':20B 'inlin':229C,245C,261C,292C,300C,308C,324C 'ip.proto':123C 'ipv6':5A,21B,37B,43B,92C,96C,101C,104C,108C,118C,137C,177C,257C,273C,304C,312C,321C 'ipv6hdr':112C 'kernel':2A,24B,31B,77C 'key':122C 'l4':148C,180C 'linux':1A,23B,30B,76C 'linux-kernel':22B 'miss':209C 'msg':350C,358C 'net':65B,84C,163C 'net/netlink/af_netlink.c':368C,380C,386C 'net/netlink/genetlink.c':354C,361C,374C 'net/openvswitch/actions.c':259C,277C,306C,316C,322C,330C,337C 'net/openvswitch/datapath.c':345C 'net/socket.c':393C 'netlink':363C,376C,382C 'nexthdr':125C,183C 'non':41B,116C 'non-first':40B,115C 'nosec':390C 'offset':50B,143C,191C,242C,297C 'open':3A,26B,33B 'open-vswitch':25B 'openvswitch':85C 'ov':332C,339C 'packet':340C 'pars':111C 'presenc':89C 'preserv':195C 'process':113C 'proto':149C,181C 'protocol':202C 'rcv':349C,357C,364C,371C 'read':45B,187C 'resolv':83C 'return':70B,128C,173C 'rewrit':7A,36B,98C 'rip':285C,293C,301C,309C 'see':210C 'sendmsg':383C,389C 'set':91C,103C,121C,133C,218C,272C,311C,320C 'skb':132C,141C,151C,214C,219C,224C,240C,287C,295C,365C 'sock':388C 'sourc':52B 'syz':233C,249C,265C,282C 'syz-executor463':232C,248C,264C,281C 'syzbot':212C 'trace':213C,319C 'transport':48B,87C,134C,142C,152C,190C,205C,215C,225C,241C,288C,296C 'trigger':8A,157C 'uncondit':139C 'unexpect':208C 'unicast':377C 'uniniti':47B,155C,189C 'updat':107C,136C,176C,256C,303C 'valid':86C 'vswitch':4A,27B,34B 'vulner':80C 'warn':13A,58B,159C,198C,220C,236C,252C,268C 'without':130C 'x14e/0x190':392C 'x226/0x4a0':367C 'x233/0x340':353C 'x28/0x40':373C 'x462/0x660':276C,315C 'x557e/0x8600':329C 'x614/0x7a0':360C 'x7bd/0x940':379C 'x813/0xb40':385C 'xb4f/0xf10':344C 'xde/0x520':336C 'y':164C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with Open vSwitch and IPv6 address rewrite actions on fragmented traffic. The sources describe the warning as appearing under CONFIG_DEBUG_NET=y; kernels built without it are not described as affected. Teams using stock distribution kernels should check their vendor's advisory for the patched kernel version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99088","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99088","severity":null,"published_at":"2026-10-26T15:16:47+00:00","modified_at":"2026-10-26T15:16:47+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}