Linux Kernel CVE-2026-68299

vmxnet3 is VMware's paravirtualized NIC driver bundled in the mainline Linux kernel and used by Linux guest VMs configured with VMXNET3 virtual adapters. Geneve (Generic Network Virtualization Encapsulation, RFC 8926) is a UDP-based tunneling protocol widely deployed in SDN overlay networks such as VMware NSX-T. In the vmxnet3 receive path, vmxnet3_get_hdr_len() reads gdesc->rcd.v4/v6/tcp flags from the RX completion descriptor to determine header length for checksum offload assistance. The code hard-codes the assumption that these flags describe the outermost Ethernet/IP/TCP headers. However, when the VMXNET3 virtual hardware processes a Geneve-encapsulated packet, it may parse the inner payload headers for offload purposes and set the VMXNET3_RCD_HDR_INNER_SHIFT bit in the completion descriptor to signal this. The unpatched driver ignores this bit, reads the outer UDP/Geneve header as if it were TCP, and hits BUG_ON(hdr.ipv4->protocol != IPPROTO_TCP) - because the outer Geneve carrier uses UDP. A second assertion failure occurs when outer and inner IP versions differ (e.g., IPv6 outer with IPv4 inner). No CWE is formally assigned by NVD; functionally this is a logic/state-assumption error (CWE-20 adjacent). Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.