CVE-2026-68296

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68296", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.380Z", "datePublished": "2026-08-10T12:02:29.464Z", "dateUpdated": "2026-11-06T16:55:12.210Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:02:32.404Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gre: fix lltx regression for GRE tunnels with SEQ/CSUM\n\nBefore commit 00d066a4d4ed (\"netdev_features: convert NETIF_F_LLTX to\ndev->lltx\"), NETIF_F_LLTX was set unconditionally in both\n__gre_tunnel_init() and ip6gre_tnl_init_features() alongside\nGRE_FEATURES:\n\n dev->features |= GRE_FEATURES | NETIF_F_LLTX;\n\nWhen that commit converted NETIF_F_LLTX to the dev->lltx flag, it\nplaced 'dev->lltx = true' after the SEQ/CSUM early returns instead\nof before them. This causes GRE/GRETAP/ip6gre tunnels with SEQ or\nCSUM+encap to lose lockless TX, reintroducing _xmit_lock acquisition\naround their ndo_start_xmit. Since GRE xmit re-enters the stack via\nip_tunnel_xmit(), holding _xmit_lock risks ABBA deadlock with the\nunderlay device.\n\n CPU0 CPU1\n ---- ----\n lock(&qdisc_xmit_lock_key#6);\n lock(&qdisc_xmit_lock_key#3);\n lock(&qdisc_xmit_lock_key#6);\n lock(&qdisc_xmit_lock_key#3);\n\nFix by moving dev->lltx = true before the early returns in both\nfunctions, restoring the original unconditional behavior."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/ip_gre.c", "net/ipv6/ip6_gre.c"], "versions": [{"version": "00d066a4d4edbe559ba6c35153da71d4b2b8a383", "lessThan": "9f948e9aede9678f4103457daf2bc9dd54c65a06", "status": "affected", "versionType": "git"}, {"version": "00d066a4d4edbe559ba6c35153da71d4b2b8a383", "lessThan": "15a1c5f2ed2eeb3daad8d5766fd506aeda4710f3", "status": "affected", "versionType": "git"}, {"version": "00d066a4d4edbe559ba6c35153da71d4b2b8a383", "lessThan": "2bffe379023512d280337c70faeb6a8cc435db5e", "status": "affected", "versionType": "git"}, {"version": "00d066a4d4edbe559ba6c35153da71d4b2b8a383", "lessThan": "675ed582c1aa4d919dd535490de08c015005c653", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/ip_gre.c", "net/ipv6/ip6_gre.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9f948e9aede9678f4103457daf2bc9dd54c65a06"}, {"url": "https://git.kernel.org/stable/c/15a1c5f2ed2eeb3daad8d5766fd506aeda4710f3"}, {"url": "https://git.kernel.org/stable/c/2bffe379023512d280337c70faeb6a8cc435db5e"}, {"url": "https://git.kernel.org/stable/c/675ed582c1aa4d919dd535490de08c015005c653"}], "title": "net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68296", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T16:46:40.818522Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:55:12.210Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68296", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T16:46:40.818522Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:46:42.695Z"}}], "cna": {"title": "net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "00d066a4d4edbe559ba6c35153da71d4b2b8a383", "lessThan": "9f948e9aede9678f4103457daf2bc9dd54c65a06", "versionType": "git"}, {"status": "affected", "version": "00d066a4d4edbe559ba6c35153da71d4b2b8a383", "lessThan": "15a1c5f2ed2eeb3daad8d5766fd506aeda4710f3", "versionType": "git"}, {"status": "affected", "version": "00d066a4d4edbe559ba6c35153da71d4b2b8a383", "lessThan": "2bffe379023512d280337c70faeb6a8cc435db5e", "versionType": "git"}, {"status": "affected", "version": "00d066a4d4edbe559ba6c35153da71d4b2b8a383", "lessThan": "675ed582c1aa4d919dd535490de08c015005c653", "versionType": "git"}], "programFiles": ["net/ipv4/ip_gre.c", "net/ipv6/ip6_gre.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"status": "unaffected", "version": "0", "lessThan": "6.12", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.101", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.42", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.6", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ipv4/ip_gre.c", "net/ipv6/ip6_gre.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/9f948e9aede9678f4103457daf2bc9dd54c65a06"}, {"url": "https://git.kernel.org/stable/c/15a1c5f2ed2eeb3daad8d5766fd506aeda4710f3"}, {"url": "https://git.kernel.org/stable/c/2bffe379023512d280337c70faeb6a8cc435db5e"}, {"url": "https://git.kernel.org/stable/c/675ed582c1aa4d919dd535490de08c015005c653"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gre: fix lltx regression for GRE tunnels with SEQ/CSUM\n\nBefore commit 00d066a4d4ed (\"netdev_features: convert NETIF_F_LLTX to\ndev->lltx\"), NETIF_F_LLTX was set unconditionally in both\n__gre_tunnel_init() and ip6gre_tnl_init_features() alongside\nGRE_FEATURES:\n\n dev->features |= GRE_FEATURES | NETIF_F_LLTX;\n\nWhen that commit converted NETIF_F_LLTX to the dev->lltx flag, it\nplaced 'dev->lltx = true' after the SEQ/CSUM early returns instead\nof before them. This causes GRE/GRETAP/ip6gre tunnels with SEQ or\nCSUM+encap to lose lockless TX, reintroducing _xmit_lock acquisition\naround their ndo_start_xmit. Since GRE xmit re-enters the stack via\nip_tunnel_xmit(), holding _xmit_lock risks ABBA deadlock with the\nunderlay device.\n\n CPU0 CPU1\n ---- ----\n lock(&qdisc_xmit_lock_key#6);\n lock(&qdisc_xmit_lock_key#3);\n lock(&qdisc_xmit_lock_key#6);\n lock(&qdisc_xmit_lock_key#3);\n\nFix by moving dev->lltx = true before the early returns in both\nfunctions, restoring the original unconditional behavior."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.101", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.42", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.6", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "6.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:02:32.404Z"}}}, "cveMetadata": {"cveId": "CVE-2026-68296", "state": "PUBLISHED", "dateUpdated": "2026-11-06T16:55:12.210Z", "dateReserved": "2026-07-30T09:28:09.380Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-10T12:02:29.464Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv4/ip_gre.c", "net/ipv6/ip6_gre.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9f948e9aede9678f4103457daf2bc9dd54c65a06", "status": "affected", "version": "00d066a4d4edbe559ba6c35153da71d4b2b8a383", "versionType": "git"}, {"lessThan": "15a1c5f2ed2eeb3daad8d5766fd506aeda4710f3", "status": "affected", "version": "00d066a4d4edbe559ba6c35153da71d4b2b8a383", "versionType": "git"}, {"lessThan": "2bffe379023512d280337c70faeb6a8cc435db5e", "status": "affected", "version": "00d066a4d4edbe559ba6c35153da71d4b2b8a383", "versionType": "git"}, {"lessThan": "675ed582c1aa4d919dd535490de08c015005c653", "status": "affected", "version": "00d066a4d4edbe559ba6c35153da71d4b2b8a383", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv4/ip_gre.c", "net/ipv6/ip6_gre.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gre: fix lltx regression for GRE tunnels with SEQ/CSUM\n\nBefore commit 00d066a4d4ed (\"netdev_features: convert NETIF_F_LLTX to\ndev->lltx\"), NETIF_F_LLTX was set unconditionally in both\n__gre_tunnel_init() and ip6gre_tnl_init_features() alongside\nGRE_FEATURES:\n\n dev->features |= GRE_FEATURES | NETIF_F_LLTX;\n\nWhen that commit converted NETIF_F_LLTX to the dev->lltx flag, it\nplaced 'dev->lltx = true' after the SEQ/CSUM early returns instead\nof before them. This causes GRE/GRETAP/ip6gre tunnels with SEQ or\nCSUM+encap to lose lockless TX, reintroducing _xmit_lock acquisition\naround their ndo_start_xmit. Since GRE xmit re-enters the stack via\nip_tunnel_xmit(), holding _xmit_lock risks ABBA deadlock with the\nunderlay device.\n\n CPU0 CPU1\n ---- ----\n lock(&qdisc_xmit_lock_key#6);\n lock(&qdisc_xmit_lock_key#3);\n lock(&qdisc_xmit_lock_key#6);\n lock(&qdisc_xmit_lock_key#3);\n\nFix by moving dev->lltx = true before the early returns in both\nfunctions, restoring the original unconditional behavior."}], "id": "CVE-2026-68296", "lastModified": "2026-11-06T17:19:28.030", "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68296", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T16:46:40.818522Z", "version": "2.0.3"}}]}, "published": "2026-08-10T13:20:19.053", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/15a1c5f2ed2eeb3daad8d5766fd506aeda4710f3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2bffe379023512d280337c70faeb6a8cc435db5e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/675ed582c1aa4d919dd535490de08c015005c653"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9f948e9aede9678f4103457daf2bc9dd54c65a06"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: GRE tunnel deadlock leads to Denial of Service", "id": "2513365", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513365"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-833", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: gre: fix lltx regression for GRE tunnels with SEQ/CSUM\nBefore commit 00d066a4d4ed (\"netdev_features: convert NETIF_F_LLTX to\ndev->lltx\"), NETIF_F_LLTX was set unconditionally in both\n__gre_tunnel_init() and ip6gre_tnl_init_features() alongside\nGRE_FEATURES:\ndev->features |= GRE_FEATURES | NETIF_F_LLTX;\nWhen that commit converted NETIF_F_LLTX to the dev->lltx flag, it\nplaced 'dev->lltx = true' after the SEQ/CSUM early returns instead\nof before them. This causes GRE/GRETAP/ip6gre tunnels with SEQ or\nCSUM+encap to lose lockless TX, reintroducing _xmit_lock acquisition\naround their ndo_start_xmit. Since GRE xmit re-enters the stack via\nip_tunnel_xmit(), holding _xmit_lock risks ABBA deadlock with the\nunderlay device.\nCPU0 CPU1\n---- ----\nlock(&qdisc_xmit_lock_key#6);\nlock(&qdisc_xmit_lock_key#3);\nlock(&qdisc_xmit_lock_key#6);\nlock(&qdisc_xmit_lock_key#3);\nFix by moving dev->lltx = true before the early returns in both\nfunctions, restoring the original unconditional behavior.", "A flaw was found in the Linux kernel's Generic Routing Encapsulation (GRE) tunnel implementation. An issue with how lockless transmission was handled for GRE tunnels with Sequence Number (SEQ) or Checksum (CSUM) features could lead to a deadlock. This deadlock occurs when the GRE transmit function re-enters the network stack, potentially causing the system to become unresponsive, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-68296", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T12:02:29Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68296\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68296\nhttps://git.kernel.org/stable/c/15a1c5f2ed2eeb3daad8d5766fd506aeda4710f3\nhttps://git.kernel.org/stable/c/2bffe379023512d280337c70faeb6a8cc435db5e\nhttps://git.kernel.org/stable/c/675ed582c1aa4d919dd535490de08c015005c653\nhttps://git.kernel.org/stable/c/9f948e9aede9678f4103457daf2bc9dd54c65a06"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[00d066a4d4edbe559ba6c35153da71d4b2b8a383,9f948e9aede9678f4103457daf2bc9dd54c65a06)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[00d066a4d4edbe559ba6c35153da71d4b2b8a383,15a1c5f2ed2eeb3daad8d5766fd506aeda4710f3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[00d066a4d4edbe559ba6c35153da71d4b2b8a383,2bffe379023512d280337c70faeb6a8cc435db5e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[00d066a4d4edbe559ba6c35153da71d4b2b8a383,675ed582c1aa4d919dd535490de08c015005c653)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,8.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc5,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T17:15:03.145708+00:00", "updated": "2026-08-13T06:00:04.718233+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}