Executive brief
A vulnerability in the Linux kernel's Google Virtual Ethernet (gve) network driver can cause incorrect packet data to be read and memory buffers to be corrupted when hardware-accelerated packet coalescing (HW-GRO) is enabled. This can lead to packet loss, TCP retransmissions, and potential data corruption in systems using GCP's gve network interface.
Technical details
The gve driver's DQO RX datapath has a race condition in header buffer management when header-split and hardware GRO are both enabled. The driver indexes header buffers by completion queue position rather than by the buffer's identity (buf_id), but HW-GRO can complete packets out-of-order, causing two problems: (1) reading headers from wrong buffer slots, leading to copying wrong packet headers and ~30% throughput degradation with TCP retransmissions, and (2) reusing header buffers while the device still owns them, corrupting in-flight packet headers. The fix indexes header buffers by buf_id on both post and read paths, ensuring correct header slot access regardless of completion ordering and preventing premature buffer reuse. The vulnerability affects the network I/O path and requires no user interaction or authentication.
Affected products
- Linux Linux kernel versions with gve driver supporting header-split and HW-GRO
Timeline
- 2026-08-15: disclosed
- patched: Fix commits address both issues by indexing header buffers by buf_id