CVE-2023-3966 is a high severity (CVSS 7.5) denial of service in Open vSwitch. Crafted Geneve packets can cause invalid memory accesses, and the issue needs hardware offloading through the netlink path to be enabled. Apply the update from your distribution and check whether offload is on.
What's affected
The NVD record says multiple Open vSwitch versions are vulnerable to crafted Geneve packets, which may cause a denial of service and invalid memory accesses. Triggering the flaw requires that hardware offloading through the netlink path is enabled.
The record does not list a version range. The Red Hat CVE page we read describes the flaw and links a Bugzilla entry titled ovs-vswitch fails to recover after malformed geneve metadata packet. Fedora package announcements are also linked from the record, so Fedora users should look at those for the fixed package.
Because fixed versions differ by distribution, use your vendor advisory for exact package numbers. We do not state an upstream fixed version here.
How to check if you're exposed
Start with the installed version and the offload setting. On a host that runs Open vSwitch, these two commands tell you most of what you need.
ovs-vsctl --version
ovs-vsctl get Open_vSwitch . other_config:hw-offload
If hw-offload is not set to true, the trigger condition in the record is not met on that host. That lowers the practical risk but does not remove the need to patch, since a later configuration change could turn offload on.
Check your package manager for the vendor fix, for example with the update tooling of your distribution, and look for hosts that run Open vSwitch inside containers or appliance images, since those are easy to miss.
What to do now
- Find every host, appliance and image that runs Open vSwitch, including network virtualization and cloud platform nodes.
- Check whether hardware offload through netlink is enabled on each one.
- Apply the Open vSwitch update from your distribution vendor.
- Where you cannot patch yet, consider filtering unexpected Geneve traffic from untrusted sources at the network edge.
- Make sure the service has monitoring and restarts, so a crash is visible and short.
Why it matters
The record lists CWE-248, an uncaught exception. A malformed packet causes the packet processing code to hit a case it does not handle, and the daemon stops serving traffic correctly. Because Open vSwitch sits in the data path of virtual networks, a single bad packet can affect many workloads at once.
The attack is limited by the offload condition, which is not the default on many systems. That is a good reason to document your configuration. The record does not claim exploitation and the CVE is not in the CISA KEV catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to patch if hardware offload is off?
The record says the trigger needs netlink hardware offload enabled. You are less exposed if it is off, but patching keeps you safe if the setting changes later.
Sources
Last reviewed: 19 October 2026.
