CVE-2025-38146 — Improper Validation of Array Index in Linux
CWE-129 — Improper Validation of Array IndexCWE-190 — Integer Overflow or Wraparound69 documents8 sources
Severity
7.8HIGHNVD
OSV3.2
EPSS
0.0%
top 91.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 3
Latest updateMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: Fix the dead loop of MPLS parse
The unexpected MPLS packet may not end with the bottom label stack.
When there are many stacks, The label count value has wrapped around.
A dead loop occurs, soft lockup/CPU stuck finally.
stack backtrace:
UBSAN: array-index-out-of-bounds in /build/linux-0Pa0xK/linux-5.15.0/net/openvswitch/flow.c:662:26
index -1 is out of range for type '__be32 [3]'
CPU: 34 PID: 0 Comm: swappe…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages4 packages
▶CVEListV5linux/linuxfbdcdd78da7c95f1b970d371e1b23cbd3aa990f3 — 4b9a086eedc1fddae632310386098c12155e3d0a+7
Also affects: Debian Linux 11.0