CVE-2026-72407

A flaw was found in the Geneve module of the Linux kernel. This vulnerability arises from an incorrect validation of the inner network offset within the geneve_gro_complete() function. A discrepancy between how geneve_gro_complete() and geneve_gro_receive() process packet information can lead to an out-of-bounds completion. This issue could allow a remote attacker to cause a denial of service (system crash).

Geneve GRO completion can recompute the inner dispatch offset independently from the offset validated earlier by geneve_gro_receive(). If the GRO hint state changes between receive and complete, or if the option bytes used by completion differ from the bytes parsed during receive, geneve_gro_complete() may dispatch past the validated inner network header. A remote peer can potentially trigger this through crafted Geneve traffic when the Geneve endpoint and GRO hint path are reachable, although practical exposure is usually limited to overlay or data center networks. For the CVSS the PR:N is used because no local account on the victim is needed when the tunnel endpoint accepts attacker controlled packets. Impact is at least denial of service via invalid packet completion and possible kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.