CVE-2026-68296: net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM

Q: What is the severity of CVE-2026-68296?

The severity rating of CVE-2026-68296 is 34, indicating a moderate risk.

Q: How do I fix CVE-2026-68296?

To resolve CVE-2026-68296, ensure that you update your Linux kernel to a version that includes the fix.

Q: What systems are affected by CVE-2026-68296?

CVE-2026-68296 affects the Linux kernel, specifically regarding GRE tunnels with SEQ/CSUM.

Q: Is CVE-2026-68296 a local or remote vulnerability?

CVE-2026-68296 is considered a local vulnerability, as it requires access to the affected system.

Q: What is the impact of CVE-2026-68296?

The impact of CVE-2026-68296 could potentially lead to issues with GRE tunnel functionality if not patched.

Published Aug 10, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM

Before commit 00d066a4d4ed ("netdevfeatures: convert NETIFFLLTX to dev->lltx"), NETIFFLLTX was set unconditionally in both gretunnelinit() and ip6gretnlinitfeatures() alongside GREFEATURES:

dev->features |= GREFEATURES | NETIFFLLTX;

When that commit converted NETIFFLLTX to the dev->lltx flag, it placed 'dev->lltx = true' after the SEQ/CSUM early returns instead of before them. This causes GRE/GRETAP/ip6gre tunnels with SEQ or CSUM+encap to lose lockless TX, reintroducing xmitlock acquisition around their ndostartxmit. Since GRE xmit re-enters the stack via iptunnelxmit(), holding xmitlock risks ABBA deadlock with the underlay device.

CPU0 CPU1 ---- ---- lock(&qdiscxmitlockkey#6); lock(&qdiscxmitlockkey#3); lock(&qdiscxmitlockkey#6); lock(&qdiscxmitlockkey#3);

Fix by moving dev->lltx = true before the early returns in both functions, restoring the original unconditional behavior.

Affected Software

138 affected componentsFixes available

Linux Linux kernel

debian/linux<6.12.101-1

6.12.101-1

debian/linux<7.1.6-1

7.1.6-1

debian/linux-6.12<6.12.101-1~deb12u1

6.12.101-1~deb12u1

linux/kernel>=6.12.0<6.12.101

6.12.101

linux/kernel>=6.13.0<6.18.42

6.18.42

linux/kernel>=6.19.0<7.1.6

7.1.6

debian/linux

6.1.176-16.1.190-16.12.107-16.12.116-17.2.15-17.3.3-1

debian/linux-6.12

6.12.115-2~deb12u1

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-aws-7.0<7.0.0-1014.14~24.04.1

7.0.0-1014.14~24.04.1

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-7.0<7.0.0-1017.17~24.04.1

7.0.0-1017.17~24.04.1

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-fde-6.17*

ubuntu/linux-azure-fde-7.0<7.0.0-1016.16~24.04.1

7.0.0-1016.16~24.04.1

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-7.0<7.0.0-1014.14~24.04.1

7.0.0-1014.14~24.04.1

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17*

ubuntu/linux-hwe-7.0<7.0.0-38.38~24.04.4

7.0.0-38.38~24.04.4

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17*

ubuntu/linux-nvidia-7.0<7.0.0-1024.25~24.04.1

7.0.0-1024.25~24.04.1

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17*

ubuntu/linux-oracle-7.0<7.0.0-1013.13~24.04.1

7.0.0-1013.13~24.04.1

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-riscv-7.0<7.0.0-38.38.1~24.04.1

7.0.0-38.38.1~24.04.1

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17*

ubuntu/linux<7.0.0-38.38

7.0.0-38.38

ubuntu/linux-aws<7.0.0-1014.14

7.0.0-1014.14

ubuntu/linux-azure<7.0.0-1017.17

7.0.0-1017.17

ubuntu/linux-azure-fde<7.0.0-1016.16

7.0.0-1016.16

ubuntu/linux-gcp<7.0.0-1014.14

7.0.0-1014.14

ubuntu/linux-gke<7.0.0-1008.9

7.0.0-1008.9

ubuntu/linux-ibm<7.0.0-1015.15

7.0.0-1015.15

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-bos<7.0.0-2022.23

7.0.0-2022.23

ubuntu/linux-oem-7.0<7.0.0-1015.15

7.0.0-1015.15

ubuntu/linux-oracle<7.0.0-1013.13

7.0.0-1013.13

ubuntu/linux-raspi*

ubuntu/linux-realtime<7.0.0-38.38.1

7.0.0-38.38.1

ubuntu/linux-riscv<7.0.0-38.38.1

7.0.0-38.38.1

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.12.101-1
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 7.1.6-1
Upgrade
Upgrade debian/linux-6.12 to a version that resolves this vulnerability.
Fixed in 6.12.101-1~deb12u1
Upgrade
Upgrade ubuntu/linux-aws-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.16~24.04.1
Upgrade
Upgrade ubuntu/linux-gcp-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38~24.04.4
Upgrade
Upgrade ubuntu/linux-nvidia-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1024.25~24.04.1
Upgrade
Upgrade ubuntu/linux-oracle-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13~24.04.1
Upgrade
Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1~24.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.16
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 7.0.0-1008.9
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 7.0.0-1015.15
Upgrade
Upgrade ubuntu/linux-nvidia-bos to a version that resolves this vulnerability.
Fixed in 7.0.0-2022.23
Upgrade
Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1015.15
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 6.12.101
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 6.18.42
Upgrade
Upgrade linux/Kernel to a version that resolves this vulnerability.
Fixed in 7.1.6
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1
Upgrade
Upgrade debian/linux-6.12 to a version that resolves this vulnerability.
Fixed in 6.12.115-2~deb12u1

Event History

Aug 10, 2026

CVE Published

via MITRE·12:02 PM

Data Sourced

via MITRE·12:02 PM

Description

Data Sourced

via OSV·12:02 PM

DescriptionAffected Software

Data Sourced

via NVD·01:20 PM

Description

Nov 11, 2026

Data Sourced

via OSV·09:40 AM

Severity

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4745-1

Frequently Asked Questions

What is the severity of CVE-2026-68296?

The severity rating of CVE-2026-68296 is 34, indicating a moderate risk.

How do I fix CVE-2026-68296?

To resolve CVE-2026-68296, ensure that you update your Linux kernel to a version that includes the fix.

What systems are affected by CVE-2026-68296?

CVE-2026-68296 affects the Linux kernel, specifically regarding GRE tunnels with SEQ/CSUM.

Is CVE-2026-68296 a local or remote vulnerability?

CVE-2026-68296 is considered a local vulnerability, as it requires access to the affected system.

What is the impact of CVE-2026-68296?

The impact of CVE-2026-68296 could potentially lead to issues with GRE tunnel functionality if not patched.

CVE-2026-68296: net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM

Affected Software

Remediation

Event History

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-68296?

How do I fix CVE-2026-68296?

What systems are affected by CVE-2026-68296?

Is CVE-2026-68296 a local or remote vulnerability?

What is the impact of CVE-2026-68296?

Company

Resources

Contact