Executive brief
The Linux kernel's GENEVE (Generic Network Virtualization Encapsulation) network packet processing component has a vulnerability in its Generic Receive Offload (GRO) handling. A remote attacker can send specially crafted network packets to trigger out-of-bounds memory access during packet completion processing, potentially causing a system crash or memory corruption on systems using GENEVE-enabled network interfaces.
Technical details
The vulnerability exists in the geneve_gro_complete() function within the GENEVE network encapsulation driver (drivers/net/geneve.c). During GRO (Generic Receive Offload) packet completion, the function independently re-derives the inner packet dispatch type and length without validating them against the offset recorded during the receive phase (geneve_gro_receive()). This can occur if the GRO hint state changes concurrently (via geneve_quiesce()/geneve_unquiesce()) or if option bytes are re-read differently. An attacker on the network can craft encapsulated packets that cause geneve_gro_complete() to compute an inner network header offset that exceeds the validated boundary, leading to out-of-bounds memory access. The fix adds validation to ensure the computed inner network header offset does not exceed NAPI_GRO_CB()->inner_network_offset. No authentication or user interaction is required; the vulnerability is triggered by network packet reception on a GENEVE-capable interface. Patches are available in the Linux kernel stable releases.
Affected products
- Linux Linux Kernel Multiple versions prior to patched release
Timeline
- 2026-08-15: disclosed: CVE-2026-72407 published on NVD
- 2026-06-24: patched: Upstream fix commit cbb0d30a1ad6fc9439b1dc9b4f5a7a9140d3b11f merged by Jakub Kicinski
- 2026-06-17: other: Fix authored by Xiang Mei with suggestions from Paolo Abeni