Executive brief
The Linux kernel's GENEVE tunneling driver contains a vulnerability in packet processing that allows an attacker to read memory outside the bounds of a network packet buffer. This can lead to information disclosure or system crashes when processing specially crafted network traffic on systems using GENEVE tunnels without GRO hint validation enabled.
Technical details
The vulnerability is a buffer over-read in the geneve_gro_complete() function caused by inconsistent GRO (Generic Receive Offload) hint handling. The geneve_gro_receive() path validates GRO hints against the socket's gs->gro_hint flag via geneve_sk_gro_hint_off(), but geneve_gro_complete() unconditionally calls the low-level geneve_opt_gro_hint_off() function without checking the socket flag. An attacker can supply a malicious GRO hint option that inflates gh_len (header length) by a crafted nested_hdr_len value, causing the inner gro_complete handler to read at an offset (nhoff + gh_len) that was never validated or pulled into the skb head. The fix gates the complete path on gs->gro_hint via geneve_sk_gro_hint_off(), ensuring both receive and complete paths apply the same validation. Tunnels with GRO hint explicitly enabled are unaffected.
Affected products
- Linux Linux kernel multiple versions (patched in commit 2651c174445884ac9e85622aeade9c1f7b98d8e5 and later)
Timeline
- 2026-08-15: disclosed: CVE-2026-72408 published
- 2026-06-24: patched: Upstream fix committed (2651c174445884ac9e85622aeade9c1f7b98d8e5)
- 2026-07-24: patched: Stable kernel backport (49c2e7c0a69999a75ef5eaebe1559a20d0b3c15a)