CVE-2026-68299

Received Received - Intake

Kernel BUG_ON in VMXNET3 Geneve Packet Handling

Publication date: 2026-08-10

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets vmxnet3_get_hdr_len() assumes gdesc->rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header instead, signalled by the VMXNET3_RCD_HDR_INNER_SHIFT bit in the completion descriptor. Since the function never skips the outer encapsulation, this mismatch triggers: - BUG_ON(hdr.ipv4->protocol != IPPROTO_TCP), because the outer protocol is UDP (Geneve), not TCP. - BUG_ON(hdr.eth->h_proto != ...), when the tunnel's outer and inner IP versions differ (e.g. outer IPv6/inner IPv4 or vice versa). Check VMXNET3_RCD_HDR_INNER_SHIFT up front and bail out, since the function cannot locate the inner header it would need to parse. Also convert the remaining BUG_ON()s in this function to return 0 defensively.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-19

Generated

2026-08-31

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68299

EUVD

EUVD-2026-55400

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	vmxnet3	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a bug in the vmxnet3 driver's function vmxnet3_get_hdr_len(). The function incorrectly assumes that certain header fields always describe the outer network packet. However, for Geneve-encapsulated packets, these fields may instead describe the inner header, leading to mismatches. This causes the function to trigger BUG_ON assertions when parsing packets, potentially crashing the system.

Detection Guidance

This vulnerability affects the Linux kernel's vmxnet3 driver when handling Geneve-encapsulated packets. Detection requires checking if the system uses the vulnerable driver version and if Geneve packets are processed. No specific commands are provided in the context, but monitoring kernel logs for BUG_ON errors related to vmxnet3_get_hdr_len() may indicate exploitation.

Impact Analysis

If you use a system with the affected Linux kernel and vmxnet3 driver, this vulnerability could cause kernel crashes (BUG_ON panics) when processing Geneve-encapsulated network packets. This may lead to denial-of-service conditions, system instability, or unexpected reboots.

Compliance Impact

This vulnerability is a kernel-level bug in the Linux vmxnet3 driver affecting Geneve-encapsulated packets. It does not directly relate to data protection, privacy, or security controls required by GDPR or HIPAA. Compliance impact would depend on system configuration and whether this bug could lead to service disruption or unauthorized access, but no evidence suggests direct non-compliance with these standards.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update the vmxnet3 driver to a version that correctly handles Geneve packets by checking VMXNET3_RCD_HDR_INNER_SHIFT. Restart affected systems to ensure the updated driver is loaded. Monitor for BUG_ON errors in kernel logs as a sign of potential exploitation.

Hi! I’m here to help you understand CVE-2026-68299. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70