CVE-2026-72351

A flaw was found in the Linux kernel's Generic UDP Encapsulation (GUE) implementation. A remote attacker could exploit a missing length validation for the remote checksum offload (REMCSUM) private option. By sending a specially crafted GUE packet, an attacker can cause the kernel to read beyond the intended buffer, potentially leading to information disclosure or a denial of service (DoS).

This vulnerability is rated as Moderate severity because although it involves an out-of-bounds memory read triggered over the network, successful exploitation requires an active Generic UDP Encapsulation (GUE) endpoint and primarily results in a denial of service or information leakage rather than arbitrary code execution. Standard Red Hat Enterprise Linux deployments are not vulnerable to this flaw, as the affected Foo-over-UDP (FOU/GUE) encapsulation driver is not enabled in supported kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.