Critical Dead Loop Vulnerability in Open vSwitch of Linux Kernel
Summary
CVE-2025-38146: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix the dead loop of MPLS parse The unexpected MPLS packet may not end with the bottom label stack. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. Open vSwitch is a multilayer virtual switch designed to enable network automation while supporting standard management interfaces and protocols. This vulnerability affects the Open vSwitch component of the Linux kernel, which is crucial for managing network traffic in virtualized environments.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the Open vSwitch module related to the parsing of MPLS packets. An unexpected MPLS packet may not conclude with the bottom label stack, leading to a scenario where the label count wraps around when multiple stacks are present. This results in a dead loop, causing a soft lockup or CPU to become unresponsive. The vulnerability is characterized by an array index out-of-bounds error, which can lead to system instability and potential denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can limit the number of MPLS stacks processed or implement additional checks in their network configurations to avoid triggering the dead loop condition until a patch is applied.
Conclusion
The dead loop vulnerability in the Open vSwitch module of the Linux kernel poses a significant risk to system stability. Users are urged to update their systems promptly to the patched versions to avoid potential exploitation. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a dead loop issue in the Open vSwitch module of the Linux kernel, caused by improper handling of MPLS packets.
Exploitation of this vulnerability can lead to a soft lockup or CPU becoming unresponsive, resulting in denial of service.
Yes, a patch has been released, and users should update their Linux packages to the latest version to mitigate the risk.
The vulnerability affects Linux kernel versions in Debian 11, 12, and 13.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
