CVE-2026-89555

The Linux kernel's MPLS forwarding path contains a use-after-free in mpls_select_multipath(): while computing a multipath hash across the MPLS label stack, the code caches a pointer to the current label header (hdr), but a later pskb_may_pull() call to bring the inner IP header into the linear skb area can trigger pskb_expand_head(), which replaces and frees the old skb head, leaving hdr dangling. An attacker can trigger this by sending crafted packets (e.g., legal Geneve packets terminated on a bareudp/MPLS multipath setup) whose inner IP header sits in nonlinear skb data, causing a slab-use-after-free read confirmed by KASAN on unpatched kernels. The flaw carries a critical 9.8 CVSS (network, no privileges, no user interaction), though in practice the observed impact is kernel memory corruption with crash/DoS potential rather than demonstrated remote code execution. Affected systems are Linux hosts and routers that forward MPLS traffic with routes carrying multiple next-hops (ECMP), particularly SDN/service-provider or lab setups combining bareudp and Geneve tunnels. Exploitation status is none known: the bug was found via static analysis with a private reproducer, there is no public PoC, and it is not in the CISA KEV catalog.

What to do: Apply kernel updates that include the fix 'mpls: reload header after pskb_may_pull()' as soon as your distribution ships it, prioritizing hosts that forward MPLS with ECMP routes or terminate bareudp/Geneve tunnels. Until patched, consider disabling MPLS ECMP hashing on affected routers or filtering untrusted tunnel ingress where feasible. Watch for kernel oops/KASAN slab-use-after-free reports in mpls_select_multipath on forwarding boxes as evidence of probing or exploitation attempts.