Skip to main content

Linux Kernel CVE-2026-72408

| EUVDEUVD-2026-59307 CRITICAL
2026-08-15 Linux GHSA-p4xr-mfr6-cf8x
Buffer Overflow Linux Red Hat Suse
Critical
Disputed · 10.0 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
10.0 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
8.2 HIGH

Remote unauthenticated packets to a default GENEVE tunnel (AV:N/AC:L/PR:N/UI:N); an OOB read gives limited disclosure (C:L) and likely kernel panic (A:H), with no integrity impact (I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:08 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
10.0 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:56 cve.org
CRITICAL 10.0
CVE Published
Aug 15, 2026 - 05:56 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint

geneve_gro_receive() reads the GRO hint through geneve_sk_gro_hint_off(), which honours it only when the socket enabled IFLA_GENEVE_GRO_HINT (gs->gro_hint). geneve_gro_complete() instead calls the low-level geneve_opt_gro_hint_off() and acts on the hint unconditionally.

On a tunnel without the hint, receive aggregates the frames as plain ETH_P_TEB while complete still honours an attacker-supplied hint option: it inflates gh_len by gro_hint->nested_hdr_len (u8) and redirects the dispatch type, so the inner gro_complete handler runs at nhoff + gh_len, an offset receive never pulled nor validated, reading out of bounds of the skb head:

BUG: KASAN: slab-out-of-bounds in ipv6_gro_complete (net/ipv6/ip6_offload.c:196) Read of size 1 at addr ffff88800fe91980 by task exploit/153 ipv6_gro_complete (net/ipv6/ip6_offload.c:196) geneve_gro_complete (drivers/net/geneve.c:965) udp_gro_complete (net/ipv4/udp_offload.c:940) inet_gro_complete (net/ipv4/af_inet.c:1621) __gro_flush (net/core/gro.c:306)

Gate the complete path on gs->gro_hint too via geneve_sk_gro_hint_off(), so both paths agree. Tunnels that enable the hint are unaffected.

AnalysisAI

Out-of-bounds kernel memory read in the Linux kernel's GENEVE tunnel GRO path (drivers/net/geneve.c) affects tunnels that have not enabled the IFLA_GENEVE_GRO_HINT feature - which is the default. geneve_gro_complete() honours an attacker-supplied GRO hint option unconditionally while geneve_gro_receive() ignores it, so the two paths disagree and dispatch the inner gro_complete handler at an unvalidated offset (nhoff + gh_len), reading past the skb head. Confirmed via a KASAN slab-out-of-bounds report in ipv6_gro_complete; there is no public exploit identified at time of analysis and EPSS is low (0.16%).

Technical ContextAI

GENEVE (Generic Network Virtualization Encapsulation, RFC 8926) is a UDP-based overlay tunneling protocol widely used in SDN/cloud fabrics (e.g. OVN, Open vSwitch, Kubernetes overlays). The kernel's Generic Receive Offload (GRO) engine aggregates incoming segments and later finalizes them in a *_gro_complete() callback. This bug is a mismatch between the receive and complete halves: geneve_gro_receive() consults the hint only through geneve_sk_gro_hint_off(), which respects the socket flag gs->gro_hint, whereas geneve_gro_complete() called the low-level geneve_opt_gro_hint_off() and acted on the hint regardless. On a tunnel without the hint enabled, frames are aggregated as plain ETH_P_TEB, but completion still inflates gh_len by an attacker-controlled gro_hint->nested_hdr_len (u8) and redirects the dispatch type, causing an inner handler to run at an offset the receive path never pulled or validated. The root cause is a classic out-of-bounds read (CWE-125, not populated in the input) arising from inconsistent trust of untrusted header fields between two code paths. The fix gates the complete path on gs->gro_hint via geneve_sk_gro_hint_off() so both paths agree.

RemediationAI

Vendor-released patch: apply the stable kernel fix (present in the 7.2-rc1 development line and backported to the 7.1.5 stable series) via commits 49c2e7c0a69999a75ef5eaebe1559a20d0b3c15a and 2651c174445884ac9e85622aeade9c1f7b98d8e5 (https://git.kernel.org/stable/c/49c2e7c0a69999a75ef5eaebe1559a20d0b3c15a). Upgrade to your distribution's kernel build that incorporates these commits and reboot. If immediate patching is not possible, the most direct compensating control is to remove exposure to the vulnerable path: tear down or avoid GENEVE tunnel interfaces where they are not required (this disables affected overlay connectivity, so only do it where GENEVE is unused), or restrict which hosts can send GENEVE UDP traffic (default port 6081) to tunnel endpoints via firewall/ACLs so only trusted overlay peers reach the GRO path (side effect: mis-scoped rules can break legitimate overlay peers). Enabling IFLA_GENEVE_GRO_HINT on tunnels also aligns the two code paths and avoids the vulnerable branch, but this changes GRO behaviour and should be validated for your workload rather than applied blindly. Disabling GRO on the receiving interface (ethtool -K <dev> gro off) removes the aggregation path entirely at a throughput/CPU cost.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72408 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy