UBUNTU-CVE-2026-72407: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: geneve: validate inner network offset in genevegrocomplete() Even with both paths gated on gs->grohint, genevegrocomplete() re-derives the inner dispatch type and length from the packet and the current gs->grohint, independently of genevegroreceive(). The two can disagree if gs->grohint flips under a concurrent genevequiesce()/ geneveunquiesce() (skuserdata is NULL across a synchronizenet()), or if the re-read option bytes differ from the ones receive parsed. genevegroreceive() already records the inner network header position in NAPIGROCB()->innernetworkoffset. Have genevegrocomplete() compute the offset it is about to dispatch at, adding ETHHLEN in the ETHPTEB case where ethgrocomplete() steps over the inner MAC header, and bail out if it lands past innernetworkoffset. Use a lower bound rather than exact equality: between ghlen and the inner L3 header, genevegroreceive() may also have pulled an inner VLAN tag (vlangroreceive() advances the recorded offset past it), which only moves innernetworkoffset further out. A valid frame therefore always satisfies innernh <= innernetworkoffset, while a ghlen inflated by a hint groreceive() did not honour dispatches past the validated inner header, i.e. the out-of-bounds completion. Only the latter is rejected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1
Event History
Frequently Asked Questions
Which systems are most likely to be exposed?
Exposure is limited to the listed Ubuntu kernel packages when they process Geneve traffic through the GRO path. The problematic condition involves disagreement between receive and completion processing, including a concurrent Geneve quiesce/unquiesce transition or differing option-byte reads.
What level of attacker access is indicated?
The supplied vector indicates network reachability, low attack complexity, no required privileges, and no user interaction. It also indicates high confidentiality, integrity, and availability impact with scope changed.