Vulnerability in Open vSwitch Transport Header Handling in Linux Kernel

CVE-2026-99088

What is CVE-2026-99088?

A transport header validation issue has been identified in Open vSwitch within the Linux kernel. When performing IPv6 address rewrite actions on fragmented packets, the function set_ipv6_addr() calls update_ipv6_checksum(). If this function processes a non-first IPv6 fragment, it incorrectly sets the protocol to NEXTHDR_FRAGMENT and exits prematurely, leaving the transport header uninitialized. This flaw can trigger warnings during debug sessions under certain configurations (CONFIG_DEBUG_NET=y) but does not pose a direct security threat. The resolution includes an early return in update_ipv6_checksum() when the l4_proto is NEXTHDR_FRAGMENT, thus preventing the evaluation of uninitialized offsets for fragments while retaining the warning for any unexpected protocol absence. Users are advised to update to the latest version to ensure robust network operation.

References