Look up another CVE · open CVE-2026-72408 in the interactive tracker

CVE-2026-72408

geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint

10.0 EPSS 0.6% AV:N

Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem drivers/net. Debian urgency: unimportant.

What to do, per Debian release

Debian's own status for CVE-2026-72408 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	not affected	6.1.190-1	Nothing to do. bookworm never shipped the vulnerable code.
Debian 13trixie	not affected	6.12.113-1	Nothing to do. trixie never shipped the vulnerable code.
Debian 14forky	fixed	7.1.5-1	Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.1.5-1	Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

geneve_gro_receive() reads the GRO hint through geneve_sk_gro_hint_off(), which honours it only when the socket enabled IFLA_GENEVE_GRO_HINT (gs->gro_hint). geneve_gro_complete() instead calls the low-level geneve_opt_gro_hint_off() and acts on the hint unconditionally. On a tunnel without the hint, receive aggregates the frames as plain ETH_P_TEB while complete still honours an attacker-supplied hint option: it inflates gh_len by gro_hint->nested_hdr_len (u8) and redirects the dispatch type, so the inner gro_complete handler runs at nhoff + gh_len, an offset receive never pulled nor validated, reading out of bounds of the skb head: BUG: KASAN: slab-out-of-bounds in ipv6_gro_complete (net/ipv6/ip6_offload.c:196) Read of size 1 at addr ffff88800fe91980 by task exploit/153 ipv6_gro_complete (net/ipv6/ip6_offload.c:196) geneve_gro_complete (drivers/net/geneve.c:965) udp_gro_complete (net/ipv4/udp_offload.c:940) inet_gro_complete (net/ipv4/af_inet.c:1621) __gro_flush (net/core/gro.c:306) Gate the complete path on gs->gro_hint too via geneve_sk_gro_hint_off(), so both paths agree. Tunnels that enable the hint are unaffected.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

drivers/net/geneve.c

What this is: NETWORKING DRIVERSMAINTAINERS section matched on drivers/net/ · netdev@vger.kernel.org · Maintained
Kernel module: geneve

Check it on the machine

grep -w CONFIG_GENEVE /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w geneve

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.

bookworm, trixie, forky, sidm

m: a loadable module on every flavour - check lsmod, can be blacklisted

Build switch: CONFIG_GENEVE

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-08-15 (2 months ago)source
CVSS: 10.0 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsource recompute it
Attack vector: network (AV:N)source
EPSS: 0.55%, higher than 45.0% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: unimportantsource
Subsystem: drivers/net

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
7.0	7.1.5	49c2e7c0a699
7.0	7.2	2651c1744458

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network: The bug is triggered by remotely delivered UDP/GENEVE packets processed in the NAPI GRO completion path (udp_gro_complete → geneve_gro_complete → __gro_flush), not via local syscalls or physical interfaces.
AC:LAttack complexity, low: The attacker controls all packet fields (GRO hint option, nested_hdr_len, inner_proto_id) and can send multiple matching datagrams to force GRO aggregation/flush; no uncontrollable race or memory layout is required.
PR:NPrivileges required, none: No authentication or local privileges are needed; any remote host that can send UDP to a victim's GENEVE tunnel port triggers the flaw on default tunnels without IFLA_GENEVE_GRO_HINT enabled.
UI:NUser interaction, none: Exploitation requires only transmission of crafted network packets; no victim interaction such as opening files, mounting filesystems, or clicking links is needed.
S:CScope, changed: In cloud/Kubernetes overlay deployments using GENEVE, a malicious tenant VM or pod can attack the host/hypervisor kernel over the underlay network, crossing the tenant-to-host security boundary.
C:HConfidentiality impact, high: geneve_gro_complete() honors attacker-supplied GRO hint options that gro_receive() ignored, inflating gh_len and dispatching inner gro_complete past validated skb data, causing slab out-of-bounds reads and enabling arbitrary kernel memory disclosure.
I:HIntegrity impact, high: Misdirected gro_complete handlers (e.g., ipv6_gro_complete) read and rewrite protocol header fields at attacker-chosen offsets beyond the skb head, providing out-of-bounds write primitives exploitable for control-flow hijacking.
A:HAvailability impact, high: The vulnerability provokes KASAN slab-out-of-bounds faults and kernel oops during GRO flush; repeated remote triggering can panic or hang the host, denying availability to all workloads.