CVE-2026-72408

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Geneve protocol implementation where the geneve gro complete() function processes GRO hints unconditionally by calling the low-level geneve opt gro hint off() function. This differs from geneve gro receive(), which only honors the hint if the socket has enabled IFLA GENEVE GRO HINT via the gs->gro hint variable.

On tunnels where the hint is not enabled, an attacker can provide a malicious hint option to inflate the gh len value using gro hint->nested hdr len. This redirects the dispatch type, causing the inner gro complete handler to execute at an unvalidated offset, leading to a slab-out-of-bounds read of the skb head. This was observed in the ipv6 gro complete() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.