{"apiVersion":"1.0","identifier":"CVE-2026-72407","description":"In the Linux kernel, the following vulnerability has been resolved: geneve: validate inner network offset in geneve_gro_complete() Even with both paths gated on gs->gro_hint, geneve_gro_complete() re-derives the inner dispatch type and length from the packet and the current gs->gro_hint, independently of geneve_gro_receive(). The two can disagree if gs->gro_hint flips under a concurrent geneve_quiesce()/ geneve_unquiesce() (sk_user_data is NULL across a synchronize_net()), or if the re-read option bytes differ from the ones receive parsed. geneve_gro_receive() already records the inner network header position in NAPI_GRO_CB()->inner_network_offset. Have geneve_gro_complete() compute the offset it is about to dispatch at, adding ETH_HLEN in the ETH_P_TEB case where eth_gro_complete() steps over the inner MAC header, and bail out if it lands past inner_network_offset. Use a lower bound rather than exact equality: between gh_len and the inner L3 header, geneve_gro_receive() may also have pulled an inner VLAN tag (vlan_gro_receive() advances the recorded offset past it), which only moves inner_network_offset further out. A valid frame therefore always satisfies inner_nh <= inner_network_offset, while a gh_len inflated by a hint gro_receive() did not honour dispatches past the validated inner header, i.e. the out-of-bounds completion. Only the latter is rejected.","publishedAt":"2026-08-15T06:22:14","lastModifiedAt":"2026-08-17T06:19:07","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72407","cvssScore":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","epssProbability":0.00516,"riskScore":1.05,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72407","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72407","en":"https://www.redsauce.net/en/cves/CVE-2026-72407","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72407","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72407","de":"https://www.redsauce.net/de/cves/CVE-2026-72407","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72407","el":"https://www.redsauce.net/el/cves/CVE-2026-72407"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72407"}}