CVE-2026-68296

Received Received - Intake

Linux Kernel GRE Tunnel SEQ/CSUM Lockless TX Regression

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM Before commit 00d066a4d4ed ("netdev_features: convert NETIF_F_LLTX to dev->lltx"), NETIF_F_LLTX was set unconditionally in both __gre_tunnel_init() and ip6gre_tnl_init_features() alongside GRE_FEATURES: dev->features |= GRE_FEATURES | NETIF_F_LLTX; When that commit converted NETIF_F_LLTX to the dev->lltx flag, it placed 'dev->lltx = true' after the SEQ/CSUM early returns instead of before them. This causes GRE/GRETAP/ip6gre tunnels with SEQ or CSUM+encap to lose lockless TX, reintroducing _xmit_lock acquisition around their ndo_start_xmit. Since GRE xmit re-enters the stack via ip_tunnel_xmit(), holding _xmit_lock risks ABBA deadlock with the underlay device. CPU0 CPU1 ---- ---- lock(&qdisc_xmit_lock_key#6); lock(&qdisc_xmit_lock_key#3); lock(&qdisc_xmit_lock_key#6); lock(&qdisc_xmit_lock_key#3); Fix by moving dev->lltx = true before the early returns in both functions, restoring the original unconditional behavior.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-31

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68296

EUVD

EUVD-2026-55397

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel affects GRE tunnels with SEQ or CSUM+encap features. A regression introduced by a commit moved the setting of the lockless TX flag (dev->lltx) after early returns in tunnel initialization functions. This causes the kernel to re-enable transmit locks for these tunnels, which can lead to potential ABBA deadlocks when the GRE xmit path re-enters the stack via ip_tunnel_xmit().

Detection Guidance

This vulnerability affects GRE tunnels with SEQ or CSUM+encap features in the Linux kernel. Detection involves checking for GRE tunnel configurations and verifying the presence of lockless TX issues. Inspect kernel logs for deadlock warnings or xmit_lock acquisitions in GRE tunnels. Use commands like 'ip -d tunnel show' to list tunnels and 'dmesg | grep -i gre' to check for related errors.

Impact Analysis

If you use GRE, GRETAP, or ip6gre tunnels with SEQ or CSUM+encap on a Linux system with the affected kernel version, this vulnerability could cause system hangs or crashes due to ABBA deadlocks. Network performance may degrade as transmit locks are re-enabled, and the system may become unresponsive under heavy network load.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel networking issue involving GRE tunnels and lockless TX operations. No data privacy or security controls are explicitly impacted by this specific flaw.

Mitigation Strategies

Apply the kernel patch that moves 'dev->lltx = true' before early returns in __gre_tunnel_init() and ip6gre_tnl_init_features(). Update to a fixed kernel version if available. Monitor for ABBA deadlocks in GRE tunnel traffic and disable SEQ/CSUM features temporarily if the patch cannot be applied immediately.

Hi! I’m here to help you understand CVE-2026-68296. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70