CVE-2026-68299: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
In the Linux kernel, the following vulnerability has been resolved:
vmxnet3: fix BUGON in vmxnet3gethdrlen() for Geneve packets
vmxnet3gethdrlen() assumes gdesc->rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header instead, signalled by the VMXNET3RCDHDRINNERSHIFT bit in the completion descriptor. Since the function never skips the outer encapsulation, this mismatch triggers:
- BUGON(hdr.ipv4->protocol != IPPROTOTCP), because the outer protocol is UDP (Geneve), not TCP. - BUGON(hdr.eth->hproto != ...), when the tunnel's outer and inner IP versions differ (e.g. outer IPv6/inner IPv4 or vice versa).
Check VMXNET3RCDHDRINNERSHIFT up front and bail out, since the function cannot locate the inner header it would need to parse. Also convert the remaining BUGON()s in this function to return 0 defensively.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68299?
The severity of CVE-2026-68299 is rated at 50.
How do I fix CVE-2026-68299?
To fix CVE-2026-68299, ensure your Linux kernel is updated to the latest version that includes the patch addressing this vulnerability.
What systems are affected by CVE-2026-68299?
CVE-2026-68299 affects systems using the vmxnet3 driver in the Linux kernel that handle Geneve packets.
What is the impact of CVE-2026-68299?
The impact of CVE-2026-68299 can lead to incorrect header length processing for Geneve packets, which may cause system instability.
Who reported CVE-2026-68299?
CVE-2026-68299 was reported by the Linux kernel development community.