CVE-2026-68123

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: fix GSO userspace truncation underflow

OVSACTIONATTRTRUNC currently stores a delta from the original skb length in OVSCB(skb)->cutlen. When a later userspace action segments a GSO skb, queuegsopackets() reuses that delta for each smaller segment. A segment can then reach queueuserspacepacket() with cutlen greater than skb->len, underflowing the length passed to skb_zerocopy().

Store the maximum preserved length instead and bound each consumer against the current skb length. Use U32_MAX as the no-truncation sentinel so the value remains valid if skb geometry changes before a consumer handles it.