VMSA-2026-0007: VMware Workstation and Fusion updates address integer-overflow and buffer overflow vulnerabilities (CVE-2026-59346, CVE-2026-59347)

Advisory ID: | VMSA-2026-0007 ---|--- Advisory Severity: | Critical CVSSv3 Range: | 8.1-9.3 Synopsis: | VMware Workstation and Fusion updates address integer-overflow and buffer overflow vulnerabilities CVE-2026-59346, CVE-2026-59347 Issue date: | 2026-09-03 Updated on: | 2026-09-03 Initial...

PT-2026-85032

Name of the Vulnerable Software and Affected Versions VMware Workstation versions 25H2 through 26H1 VMware Fusion versions 25H2 through 26H1 Description A stack-based buffer-overflow exists in HGFS. A malicious actor with local administrative privileges on a virtual machine can exploit this to...

PT-2026-85031

Name of the Vulnerable Software and Affected Versions VMware Workstation versions 25H2 through 26H1 VMware Fusion versions 25H2 through 26H1 Description An integer overflow exists in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a guest virtual...

VMware ESX 8.0 / 9.0 / 9.1 Out-of-Bounds Write (VMSA-2026-0006)

The version of VMware ESX installed on the remote host is 8.0 prior to build 25595708 8.0 Update 3k, or 9.0 prior to build 25595025 9.0.2.0100, or 9.1 prior to build 25557999 9.1.0.0200. It is, therefore, affected by a vulnerability as referenced in the VMSA-2026-0006.1 advisory: - VMware ESX...

SUSE CVE-2026-68299

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets vmxnet3gethdrlen assumes gdesc-rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header...

CVE-2026-68299

A flaw was found in the vmxnet3 virtual network device driver within the Linux kernel. When processing Geneve-encapsulated packets, the vmxnet3gethdrlen function can incorrectly interpret header information, leading to a mismatch between expected and actual packet protocols or IP versions. This c...

vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

...

CVE-2026-68299

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets vmxnet3gethdrlen assumes gdesc-rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header...

UBUNTU-CVE-2026-68299

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets vmxnet3gethdrlen assumes gdesc-rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header...

CVE-2026-68299

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets vmxnet3gethdrlen assumes gdesc-rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header...

CVE-2026-68299 vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets vmxnet3gethdrlen assumes gdesc-rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header...

CVE-2026-68299

Summary: CVE-2026-68299 affects the Linux kernel vmxnet3 driver. When handling Geneve-encapsulated packets, vmxnet3_get_hdr_len() may misinterpret header fields because gdesc->rcd.v4/v6/tcp describe the outer header, while the inner header can differ. The completion descriptor’s VMXNET3_RCD_HD...

CVE-2026-68299 vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets vmxnet3gethdrlen assumes gdesc-rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header...

CVE-2026-68299 vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets vmxnet3gethdrlen assumes gdesc-rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header...

VMXNET3 Virtual Network Adapter Code Execution

The vulnerability of the VMXNET3 virtual network adapter in the VMware ESX hypervisor is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

PT-2026-69699

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vmxnet3 get hdr len function where it incorrectly assumes that gdesc-rcd.v4, gdesc-rcd.v6, and gdesc-rcd.tcp always describe the outer header. For...

CVE-2026-68299: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets vmxnet3gethdrlen assumes gdesc-rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header...

Linux Distros Unpatched Vulnerability : CVE-2026-68299

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets vmxnet3gethdrlen assumes gdesc-rcd.v4/v6/tcp always describe the outer header, but for a...

CVE-2026-68299: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets vmxnet3gethdrlen assumes gdesc-rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header...

CVE-2026-47876

VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Non VMXNET3 virtual adapters are no...