517 matches found
CVE-2026-74406
In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease could set sk-skuserdata to NULL while vxlangropreparereceive is running. Let's check if rcudereferenceskuserdata is NULL after skbgroremcsuminit...
CVE-2026-72408 geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
In the Linux kernel, the following vulnerability has been resolved: geneve: gate GRO hint in genevegrocomplete on gs-grohint genevegroreceive reads the GRO hint through geneveskgrohintoff, which honours it only when the socket enabled IFLAGENEVEGROHINT gs-grohint. genevegrocomplete instead calls...
EUVD-2026-59307
In the Linux kernel, the following vulnerability has been resolved: geneve: gate GRO hint in genevegrocomplete on gs-grohint genevegroreceive reads the GRO hint through geneveskgrohintoff, which honours it only when the socket enabled IFLAGENEVEGROHINT gs-grohint. genevegrocomplete instead calls...
CVE-2026-72408
Summary of the CVE-2026-72408 vulnerability (Linux kernel): The issue, in geneve GRO handling, arises when geneve_gro_complete() processes a GRO hint unconditionally while geneve_gro_receive() may honor the hint only if gs->gro_hint is enabled. This mismatch allowed an attacker-supplied GRO hi...
CVE-2026-72408 geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
In the Linux kernel, the following vulnerability has been resolved: geneve: gate GRO hint in genevegrocomplete on gs-grohint genevegroreceive reads the GRO hint through geneveskgrohintoff, which honours it only when the socket enabled IFLAGENEVEGROHINT gs-grohint. genevegrocomplete instead calls...
CVE-2026-72407 geneve: validate inner network offset in geneve_gro_complete()
In the Linux kernel, the following vulnerability has been resolved: geneve: validate inner network offset in genevegrocomplete Even with both paths gated on gs-grohint, genevegrocomplete re-derives the inner dispatch type and length from the packet and the current gs-grohint, independently of...
CVE-2026-72407 geneve: validate inner network offset in geneve_gro_complete()
In the Linux kernel, the following vulnerability has been resolved: geneve: validate inner network offset in genevegrocomplete Even with both paths gated on gs-grohint, genevegrocomplete re-derives the inner dispatch type and length from the packet and the current gs-grohint, independently of...
EUVD-2026-59306
In the Linux kernel, the following vulnerability has been resolved: geneve: validate inner network offset in genevegrocomplete Even with both paths gated on gs-grohint, genevegrocomplete re-derives the inner dispatch type and length from the packet and the current gs-grohint, independently of...
CVE-2026-72407
The CVE describes a Linux kernel vulnerability in geneve GRO handling where geneve_gro_complete() could derive a dispatch offset from stale or conflicting state (gs->gro_hint) vs the actual inner header parsed by geneve_gro_receive(), potentially leading to out-of-bounds processing. The fix en...
CVE-2026-72046 gve: fix header buffer corruption with header-split and HW-GRO
In the Linux kernel, the following vulnerability has been resolved: gve: fix header buffer corruption with header-split and HW-GRO The DQO RX datapath programs a per-buffer-queue-descriptor headerbufaddr at post time and reads the split header back at completion time. Both the post and the read...
CVE-2026-72046 gve: fix header buffer corruption with header-split and HW-GRO
In the Linux kernel, the following vulnerability has been resolved: gve: fix header buffer corruption with header-split and HW-GRO The DQO RX datapath programs a per-buffer-queue-descriptor headerbufaddr at post time and reads the split header back at completion time. Both the post and the read...
CVE-2026-72046
The CVE-2026-72046 issue in the Linux kernel concerns the gve RX path, where header buffers were indexed by buffer-queue position (bufq->tail) for posts and by the completion index (desc_idx) for reads. With HW-GRO and multi-flow traffic, out-of-order completions cause headers to be read from ...
EUVD-2026-59004
In the Linux kernel, the following vulnerability has been resolved: gve: fix header buffer corruption with header-split and HW-GRO The DQO RX datapath programs a per-buffer-queue-descriptor headerbufaddr at post time and reads the split header back at completion time. Both the post and the read...
PT-2026-72235
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the gve driver where header buffer corruption occurs when header-split and HW-GRO Hardware Generic Receive Offload are enabled. The DQO RX datapath incorrectly indexes...
PT-2026-72842
In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlan gro prepare receive. udp tunnel sock release could set sk-sk user data to NULL while vxlan gro prepare receive is running. Let's check if rcu dereference sk user data is NULL after skb...
PT-2026-72595
In the Linux kernel, the following vulnerability has been resolved: geneve: validate inner network offset in geneve gro complete Even with both paths gated on gs-gro hint, geneve gro complete re-derives the inner dispatch type and length from the packet and the current gs-gro hint, independently ...
CVE-2026-68136
A flaw was found in the Linux kernel's Generic Receive Offload GRO networking subsystem. An attacker could exploit this by sending specially crafted network packets that cause a double aggregation of flush-marked socket buffers skbs. This issue arises from a missing flush check, which allows...
AZL-94919 CVE-2026-68136 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 "net-gro: Fix GRO flush when receiving a GSO packet." added a flush check to skbgroreceive, but skbgroreceivelist lacks the same validation. As a result,...
CVE-2026-68136
In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 "net-gro: Fix GRO flush when receiving a GSO packet." added a flush check to skbgroreceive, but skbgroreceivelist lacks the same validation. As a result,...
UBUNTU-CVE-2026-68136
In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 "net-gro: Fix GRO flush when receiving a GSO packet." added a flush check to skbgroreceive, but skbgroreceivelist lacks the same validation. As a result,...