CVE-2025-38146 is a vulnerability in the Linux kernel's Open vSwitch networking subsystem where parsing of unexpected MPLS packets that do not end with the bottom label stack can cause the label count to wrap around, resulting in an infinite loop and CPU soft lockup. This is due to an out-of-bounds array index error detected by UBSAN in the flow.c file of Open vSwitch. The issue was resolved by fixing the MPLS parsing logic to prevent the dead loop. The vulnerability has a CVSS v3.1 score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H), indicating network exploitable with no privileges required, causing high impact on confidentiality and availability, and low impact on integrity. Ubuntu has issued security advisories USN-7769-1 and USN-7770-1 with patches for various kernel packages including generic, AWS, GCP, Oracle, and real-time kernels. Users must update to the fixed kernel versions and reboot their systems. Due to ABI changes, recompilation of third-party kernel modules is required after update.

The vulnerability can cause a system CPU to become stuck in a soft lockup due to an infinite loop triggered by malformed MPLS packets processed by Open vSwitch. This results in denial of service by making the CPU unresponsive. The CVSS score of 9.4 reflects a high severity with potential for remote exploitation without authentication, impacting system availability and confidentiality. There is no indication of known exploits in the wild at this time.

An official fix is available and has been released by Ubuntu in multiple kernel package updates (see advisories USN-7769-1 and USN-7770-1). Users should promptly apply the relevant kernel updates for their distribution and hardware platform and reboot the system to activate the fixes. Due to ABI changes in the kernel, recompilation and reinstallation of any third-party kernel modules is necessary after updating. No additional mitigations are specified beyond applying the official patches.