Look up another CVE · open CVE-2026-68129 in the interactive tracker
CVE-2026-68129
gve: fix Rx queue stall on alloc failure
Published 2026-08-10 (2 months ago) by the Linux kernel CNA. Subsystem drivers/net. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-68129 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.101-1 | Update the kernel and reboot. Fixed in 6.12.101-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4745-1 · 2026-08-18 · text | 6.12.101-1~deb12u1 | Update the kernel and reboot. DLA-4745-1 shipped the fix on 2026-08-18, in 6.12.101-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
When the system is under extreme memory pressure, page allocations can fail during the Rx buffer refill loop. If the number of buffers posted to hardware falls below a critical low threshold and the refill loop exits due to allocation failures, the queue can stall: 1. The device drops incoming packets because there are no descriptors. 2. Since no packets are processed, no Rx completions are generated. 3. Because no completions occur, NAPI is never scheduled, preventing the refill loop from running again even after memory is freed. This results in a permanent queue stall. Resolve this by introducing a starvation recovery timer for each Rx queue. If the number of buffers posted to hardware falls below a critical low threshold, start a timer to periodically reschedule NAPI. Once NAPI runs and successfully refills the queue above the threshold, the timer is not rescheduled. The threshold is set to 32 because a single maximum-sized Receive Segment Coalescing (RSC) packet can consume up to 19 descriptors in the Rx path. Lower thresholds (such as 8 or 16) would be insufficient to process a complete maximum-sized RSC packet, risking packet drops or unexpected hardware behavior under memory pressure. Setting the threshold to 32 guarantees a safe margin to handle at least one full RSC packet.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/net/ethernet/google/gve/gve.h
drivers/net/ethernet/google/gve/gve_rx_dqo.c
- What this is
- GOOGLE ETHERNET DRIVERSMAINTAINERS section matched on drivers/net/ethernet/google · netdev@vger.kernel.org · Maintained
- Kernel module
- gve
Check it on the machine
grep -wE 'CONFIG_ETHERNET|CONFIG_GVE|CONFIG_NET_VENDOR_GOOGLE' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w gvePrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, i386/686, i386/686-pae, i386/rt/686-pae, ppc64el/powerpc64le
- trixieMnot built on armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- forky, sidMnot built on armhf/armmp, armhf/armmp-lpae, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- bookworm · linux-6.12Mnot built on armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le, ppc64el/powerpc64le-64k
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_ETHERNET, CONFIG_GVE, CONFIG_NET_VENDOR_GOOGLE
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-10 (2 months ago)source
- CVSS
- 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.51%, higher than 42.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/net
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.14 | 5.15.216 | 9db46e19e5d6 |
| 5.14 | 6.1.183 | 42d525e751c6 |
| 5.14 | 6.6.151 | 299d5728a731 |
| 5.14 | 6.12.101 | 0c317349b4ba |
| 5.14 | 6.18.42 | 91e0249f3ef6 |
| 5.14 | 7.1.6 | 689b9f588d2d |
| 5.14 | 7.2 | b65352a1bac6 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
| DLA-4745-1 | 2026-08-18 | bookworm 6.12.101-1~deb12u1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The flaw is in the gVNIC receive/refill path driven by incoming network traffic on internet-facing Google Cloud VMs; remote packets trigger NAPI polling that reaches gve_rx_post_buffers_dqo() where the stall occurs.
- AC:LAttack complexity, low
- An attacker can reliably drive the vulnerable refill loop by sending high-volume traffic to exhaust RX page-pool buffers and pressure GFP_ATOMIC allocations; no race or rare layout is required beyond sustained network load.
- PR:NPrivileges required, none
- Exploitation requires only the ability to send packets to the VM's gVNIC interface; no local account, capabilities, or authentication is needed on internet-reachable cloud instances.
- UI:NUser interaction, none
- No victim interaction is required; the permanent RX queue stall is triggered automatically during kernel packet receive processing under memory pressure.
- S:UScope, unchanged
- Impact is confined to the affected guest's network stack and does not cross VM, container, or IOMMU security boundaries; it is a guest-local denial of service, not an escape.
- C:NConfidentiality impact, none
- This is a resource-management logic bug causing queue starvation with no out-of-bounds access, use-after-free, or information disclosure; no kernel or user memory is read by the attacker.
- I:NIntegrity impact, none
- The bug causes a permanent receive-queue stall without modifying kernel data structures, user data, or enabling code execution; there is no integrity impact beyond loss of connectivity.
- A:HAvailability impact, high
- A failed refill below the 32-descriptor threshold permanently stalls the RX queue because no completions schedule NAPI again, causing lasting loss of network receive capability until reboot.