Threats tagged 'ghsa-gqv9-8gxf-xx6g'

A vulnerability in the Linux kernel's MPLS networking code allows stale inner network header information to persist after MPLS labels are popped. This can lead to out-of-bounds memory access and kernel crashes when Open vSwitch re-pushes MPLS labels on packets with outdated header offsets. The issue arises because skb_mpls_pop() does not clear the inner_protocol field, causing subsequent operations to use invalid offsets. This flaw has been resolved by clearing inner_protocol when the last MPLS label is removed.