CVE-2026-72046

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

gve: fix header buffer corruption with header-split and HW-GRO

The DQO RX datapath programs a per-buffer-queue-descriptor

header_buf_addr at post time and reads the split header back at

completion time. Both the post and the read currently index the

header buffer by queue position rather than by the buffer's identity:

- post (gve_rx_post_buffers_dqo): header_buf_addr is computed from

bufq->tail

- read (gve_rx_dqo): the header is read from desc_idx (the completion

queue head index)

This relies on the buffer-queue index and the completion-queue index

being equal for the start of every packet, i.e. on the device consuming

posted buffers and returning completions in the exact same order. That

assumption does not hold once HW-GRO is enabled with multiple

flows: coalesced segments are accepted and completed in an order that

may differ from the order buffers were posted, and segments from

different flows may i

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References