CVE-2026-72407

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72407", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.926Z", "datePublished": "2026-08-15T05:56:30.847Z", "dateUpdated": "2026-08-17T05:43:47.398Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:43:47.398Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngeneve: validate inner network offset in geneve_gro_complete()\n\nEven with both paths gated on gs->gro_hint, geneve_gro_complete()\nre-derives the inner dispatch type and length from the packet and the\ncurrent gs->gro_hint, independently of geneve_gro_receive(). The two can\ndisagree if gs->gro_hint flips under a concurrent geneve_quiesce()/\ngeneve_unquiesce() (sk_user_data is NULL across a synchronize_net()), or if\nthe re-read option bytes differ from the ones receive parsed.\n\ngeneve_gro_receive() already records the inner network header position in\nNAPI_GRO_CB()->inner_network_offset. Have geneve_gro_complete() compute the\noffset it is about to dispatch at, adding ETH_HLEN in the ETH_P_TEB case\nwhere eth_gro_complete() steps over the inner MAC header, and bail out if\nit lands past inner_network_offset.\n\nUse a lower bound rather than exact equality: between gh_len and the inner\nL3 header, geneve_gro_receive() may also have pulled an inner VLAN tag\n(vlan_gro_receive() advances the recorded offset past it), which only moves\ninner_network_offset further out. A valid frame therefore always satisfies\ninner_nh <= inner_network_offset, while a gh_len inflated by a hint\ngro_receive() did not honour dispatches past the validated inner header,\ni.e. the out-of-bounds completion. Only the latter is rejected."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in geneve_gro_complete() on the NAPI GRO receive path for UDP-encapsulated GENEVE frames; a remote peer can deliver crafted packets to a listening GENEVE UDP port on cloud/overlay hosts without local access.\nAC:L - An attacker can reliably trigger the mismatch by flooding GRO-eligible GENEVE frames with crafted GRO-hint options and timing them against geneve_quiesce()/geneve_unquiesce() during changelink, or self-trigger that race with CAP_NET_ADMIN in a user namespace.\nPR:N - Exploitation requires no credentials or capabilities on the victim; the attacker only needs network reachability to a host already running a gro_hint-enabled GENEVE tunnel, which is common on overlay networks.\nUI:N - Exploitation is fully automated through malicious network traffic and does not require any victim user action such as mounting filesystems or opening files.\nS:C - On cloud/overlay deployments a tenant VM or remote overlay peer can corrupt the hypervisor/host kernel through underlay GENEVE GRO processing, crossing the guest/host security boundary.\nC:H - When gro_complete() dispatches past inner_network_offset, eth_gro_complete() and inet_gro_complete() read headers from attacker-influenced out-of-bounds skb memory, enabling arbitrary kernel memory disclosure.\nI:H - The same out-of-bounds gro_complete dispatch writes header fields (e.g., iph->tot_len and iph->check in inet_gro_complete()), causing memory corruption that can be leveraged for arbitrary write or code execution.\nA:H - Out-of-bounds GRO completion can cause kernel oops/panic or forced skb drop under error paths, enabling repeatable remote denial of service against the host."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/geneve.c"], "versions": [{"version": "fd0dd796576e1a560e1441e665810129f0a82be0", "lessThan": "e2087447f562692ff0cd08a0554d8d4ad083aa5c", "status": "affected", "versionType": "git"}, {"version": "fd0dd796576e1a560e1441e665810129f0a82be0", "lessThan": "cbb0d30a1ad6fc9439b1dc9b4f5a7a9140d3b11f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/geneve.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e2087447f562692ff0cd08a0554d8d4ad083aa5c"}, {"url": "https://git.kernel.org/stable/c/cbb0d30a1ad6fc9439b1dc9b4f5a7a9140d3b11f"}], "title": "geneve: validate inner network offset in geneve_gro_complete()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/geneve.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e2087447f562692ff0cd08a0554d8d4ad083aa5c", "status": "affected", "version": "fd0dd796576e1a560e1441e665810129f0a82be0", "versionType": "git"}, {"lessThan": "cbb0d30a1ad6fc9439b1dc9b4f5a7a9140d3b11f", "status": "affected", "version": "fd0dd796576e1a560e1441e665810129f0a82be0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/geneve.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngeneve: validate inner network offset in geneve_gro_complete()\n\nEven with both paths gated on gs->gro_hint, geneve_gro_complete()\nre-derives the inner dispatch type and length from the packet and the\ncurrent gs->gro_hint, independently of geneve_gro_receive(). The two can\ndisagree if gs->gro_hint flips under a concurrent geneve_quiesce()/\ngeneve_unquiesce() (sk_user_data is NULL across a synchronize_net()), or if\nthe re-read option bytes differ from the ones receive parsed.\n\ngeneve_gro_receive() already records the inner network header position in\nNAPI_GRO_CB()->inner_network_offset. Have geneve_gro_complete() compute the\noffset it is about to dispatch at, adding ETH_HLEN in the ETH_P_TEB case\nwhere eth_gro_complete() steps over the inner MAC header, and bail out if\nit lands past inner_network_offset.\n\nUse a lower bound rather than exact equality: between gh_len and the inner\nL3 header, geneve_gro_receive() may also have pulled an inner VLAN tag\n(vlan_gro_receive() advances the recorded offset past it), which only moves\ninner_network_offset further out. A valid frame therefore always satisfies\ninner_nh <= inner_network_offset, while a gh_len inflated by a hint\ngro_receive() did not honour dispatches past the validated inner header,\ni.e. the out-of-bounds completion. Only the latter is rejected."}], "id": "CVE-2026-72407", "lastModified": "2026-08-17T06:19:07.453", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:14.300", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cbb0d30a1ad6fc9439b1dc9b4f5a7a9140d3b11f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e2087447f562692ff0cd08a0554d8d4ad083aa5c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: geneve: validate inner network offset in geneve_gro_complete()", "id": "2516478", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516478"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-823", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ngeneve: validate inner network offset in geneve_gro_complete()\nEven with both paths gated on gs->gro_hint, geneve_gro_complete()\nre-derives the inner dispatch type and length from the packet and the\ncurrent gs->gro_hint, independently of geneve_gro_receive(). The two can\ndisagree if gs->gro_hint flips under a concurrent geneve_quiesce()/\ngeneve_unquiesce() (sk_user_data is NULL across a synchronize_net()), or if\nthe re-read option bytes differ from the ones receive parsed.\ngeneve_gro_receive() already records the inner network header position in\nNAPI_GRO_CB()->inner_network_offset. Have geneve_gro_complete() compute the\noffset it is about to dispatch at, adding ETH_HLEN in the ETH_P_TEB case\nwhere eth_gro_complete() steps over the inner MAC header, and bail out if\nit lands past inner_network_offset.\nUse a lower bound rather than exact equality: between gh_len and the inner\nL3 header, geneve_gro_receive() may also have pulled an inner VLAN tag\n(vlan_gro_receive() advances the recorded offset past it), which only moves\ninner_network_offset further out. A valid frame therefore always satisfies\ninner_nh <= inner_network_offset, while a gh_len inflated by a hint\ngro_receive() did not honour dispatches past the validated inner header,\ni.e. the out-of-bounds completion. Only the latter is rejected.", "A flaw was found in the Geneve module of the Linux kernel. This vulnerability arises from an incorrect validation of the inner network offset within the geneve_gro_complete() function. A discrepancy between how geneve_gro_complete() and geneve_gro_receive() process packet information can lead to an out-of-bounds completion. This issue could allow a remote attacker to cause a denial of service (system crash)."], "name": "CVE-2026-72407", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72407\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72407\nhttps://lore.kernel.org/linux-cve-announce/2026081522-CVE-2026-72407-b76a@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fd0dd796576e1a560e1441e665810129f0a82be0,e2087447f562692ff0cd08a0554d8d4ad083aa5c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fd0dd796576e1a560e1441e665810129f0a82be0,cbb0d30a1ad6fc9439b1dc9b4f5a7a9140d3b11f)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T18:15:03.782051+00:00", "updated": "2026-08-22T05:30:17.947500+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}