CVE-2026-72408

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint

geneve_gro_receive() reads the GRO hint through geneve_sk_gro_hint_off(),

which honours it only when the socket enabled IFLA_GENEVE_GRO_HINT

(gs->gro_hint). geneve_gro_complete() instead calls the low-level

geneve_opt_gro_hint_off() and acts on the hint unconditionally.

On a tunnel without the hint, receive aggregates the frames as plain

ETH_P_TEB while complete still honours an attacker-supplied hint option: it

inflates gh_len by gro_hint->nested_hdr_len (u8) and redirects the dispatch

type, so the inner gro_complete handler runs at nhoff + gh_len, an offset

receive never pulled nor validated, reading out of bounds of the skb head:

BUG: KASAN: slab-out-of-bounds in ipv6_gro_complete (net/ipv6/ip6_offload.c:196)

Read of size 1 at addr ffff88800fe91980 by task exploit/153

ipv6_gro_complete (net/ipv6/ip6_offload.c:196)

geneve_gro_complete (drive

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References