PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-31679 Linux CVE debrief

A vulnerability in the Linux kernel's openvswitch implementation allows for an invalid MPLS payload length, which can lead to a crash or potentially other consequences. The issue arises from the validate_set() function accepting OVS_KEY_ATTR_MPLS as a variable-sized payload for SET/SET_MASKED actions, while the action handling expects fixed-size MPLS key data. This discrepancy can cause the kernel to crash or behave unexpectedly. The vulnerability has been resolved by adding validation for the MPLS payload length.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-25
Original CVE updated
2026-10-19
Advisory published
2026-04-25
Advisory updated
2026-10-19

Who should care

Linux system administrators and users who utilize openvswitch should assess their exposure to this vulnerability and apply the provided patches to ensure the correct MPLS payload length validation is in place.

Why it matters

The vulnerability in the Linux kernel's openvswitch implementation can lead to a crash or potentially other consequences if not properly validated. Linux system administrators and users who utilize openvswitch should assess their exposure to this vulnerability and apply the provided patches to ensure the correct MPLS payload length validation is in place.

  • Verify MPLS payload length validation in openvswitch to prevent potential crashes or unexpected behavior.
  • Review and apply patches to ensure the Linux kernel is up-to-date with the latest security updates.
  • Monitor the system for any unexpected behavior or crashes related to openvswitch.

Technical summary

The Linux kernel's openvswitch implementation does not properly validate MPLS payload lengths, leading to a potential crash or other unexpected behavior. The validate_set() function accepts variable-sized payloads for SET/SET_MASKED actions, while the action handling expects fixed-size data. This discrepancy can cause the kernel to crash or behave unexpectedly. Affected Linux system administrators should assess their exposure to this vulnerability and apply patches to ensure correct MPLS payload length validation, verifying that the Linux kernel is up-to-date with the latest security patches and monitoring the system for unexpected behavior or crashes related to openvswitch.

Defensive priority

Medium

Recommended defensive actions

  • Review and apply the provided patches to ensure the openvswitch implementation is using the correct MPLS payload length validation.
  • Verify that the Linux kernel is up-to-date with the latest security patches.
  • Monitor the system for any unexpected behavior or crashes related to openvswitch.
  • Verify MPLS payload length validation in openvswitch to prevent potential crashes or unexpected behavior.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by a mismatch between the expected and actual sizes of MPLS key data in the openvswitch implementation. The validate_set() function accepts variable-sized payloads for SET/SET_MASKED actions, while the action handling expects fixed-size data. This can lead to a crash or other unexpected behavior.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-31679 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-31679

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-31679 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-31679

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • openvswitch: validate MPLS set/set_masked payload length

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/31xxx/CVE-2026-31679.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/68f32ef0683c8d1c05cd2e4f16818fa63ff59c6f

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4cae986225f8b8679ad86b924918e7d75a96aa61

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8ed7b9930cbc3bc71f868fa79a68700ac88d586a

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c1f97152df8dfb17e855ddf0fc409b7bd13e9700

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/98de18d327ef8cbbb704980e359e4872d8c28997

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bd50c7484c3bb34097571c1334174fb8b7408036

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2ca33b88a79ca42f017ae0f7011280325655438e

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.