CVE-2026-72408

Received Received - Intake

Buffer Overflow in Linux Kernel Geneve Tunnel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint geneve_gro_receive() reads the GRO hint through geneve_sk_gro_hint_off(), which honours it only when the socket enabled IFLA_GENEVE_GRO_HINT (gs->gro_hint). geneve_gro_complete() instead calls the low-level geneve_opt_gro_hint_off() and acts on the hint unconditionally. On a tunnel without the hint, receive aggregates the frames as plain ETH_P_TEB while complete still honours an attacker-supplied hint option: it inflates gh_len by gro_hint->nested_hdr_len (u8) and redirects the dispatch type, so the inner gro_complete handler runs at nhoff + gh_len, an offset receive never pulled nor validated, reading out of bounds of the skb head: BUG: KASAN: slab-out-of-bounds in ipv6_gro_complete (net/ipv6/ip6_offload.c:196) Read of size 1 at addr ffff88800fe91980 by task exploit/153 ipv6_gro_complete (net/ipv6/ip6_offload.c:196) geneve_gro_complete (drivers/net/geneve.c:965) udp_gro_complete (net/ipv4/udp_offload.c:940) inet_gro_complete (net/ipv4/af_inet.c:1621) __gro_flush (net/core/gro.c:306) Gate the complete path on gs->gro_hint too via geneve_sk_gro_hint_off(), so both paths agree. Tunnels that enable the hint are unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72408

EUVD

EUVD-2026-59307

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the GENEVE (Generic Network Virtualization Encapsulation) tunnel implementation. It involves a mismatch in how GRO (Generic Receive Offload) hints are handled between receive and completion paths. The receive path respects the GRO hint setting, but the completion path does not, leading to an out-of-bounds memory read when processing attacker-supplied data.

Detection Guidance

This vulnerability involves a kernel out-of-bounds read in GRO handling for GENEVE tunnels. Detection requires checking kernel logs for KASAN reports or slab-out-of-bounds errors related to ipv6_gro_complete or geneve_gro_complete. Monitor for crashes or unusual network behavior in GENEVE tunnels.

Impact Analysis

An attacker could exploit this to cause a kernel crash (denial of service) or potentially execute arbitrary code with kernel privileges. Systems using GENEVE tunnels without the GRO hint enabled are vulnerable to out-of-bounds memory access.

Compliance Impact

This vulnerability is a Linux kernel flaw that could allow out-of-bounds memory access, potentially leading to crashes or arbitrary code execution. While it does not directly impact compliance with standards like GDPR or HIPAA, such vulnerabilities may affect system integrity and data protection measures required by these regulations.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. Disable GENEVE GRO hints if not required by setting IFLA_GENEVE_GRO_HINT to 0. Restrict access to GENEVE tunnels to trusted sources only. Monitor network traffic for anomalies.

Hi! I’m here to help you understand CVE-2026-72408. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70