{"id":"CVE-2026-68299","revision":"3bfd97d7f0fa4ec48c6c32a976380cc7","records":[{"revision":"3bfd97d7f0fa4ec48c6c32a976380cc7","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-68299","aliases":[],"title":"vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets\n\nvmxnet3_get_hdr_len() assumes gdesc->rcd.v4/v6/tcp always describe the\nouter header, but for a Geneve-encapsulated packet the device can set\nthem based on the inner header instead, signalled by the\nVMXNET3_RCD_HDR_INNER_SHIFT bit in the completion descriptor. Since the\nfunction never skips the outer encapsulation, this mismatch triggers:\n\n- BUG_ON(hdr.ipv4->protocol != IPPROTO_TCP), because the outer\n  protocol is UDP (Geneve), not TCP.\n- BUG_ON(hdr.eth->h_proto != ...), when the tunnel's outer and inner\n  IP versions differ (e.g. outer IPv6/inner IPv4 or vice versa).\n\nCheck VMXNET3_RCD_HDR_INNER_SHIFT up front and bail out, since the\nfunction cannot locate the inner header it would need to parse. Also\nconvert the remaining BUG_ON()s in this function to return 0\ndefensively.","state":0,"publishedAt":"2026-08-10T12:02:33.213+00:00","modifiedAt":"2026-10-19T21:09:04.053+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/vmxnet3/vmxnet3_drv.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc\",\n                            \"lessThan\": \"2ddf51fcb6dd7d55ceef38e2e1a5ab2ab7fd47b0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc\",\n                            \"lessThan\": \"fbab6b73cc086e32698c86e43d1b16bf17d24c36\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc\",\n                            \"lessThan\": \"28e382646417c7e2be9c9a7079eddf627ff52b90\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc\",\n                            \"lessThan\": \"667b6e52048eaf4dbcf1707ed87ffd44abb9cb38\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc\",\n                            \"lessThan\": \"28cb5d8d13b4c1faf3f688f62e5df82fe7b438d8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc\",\n                            \"lessThan\": \"4fdb0f162ccdbe9626863b10003855703253fa29\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc\",\n                            \"lessThan\": \"b28596baf87e25a078789f1c05817c8a3bf71257\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc\",\n                            \"lessThan\": \"34a71f5361fc3adb5b7138da78750b0d535a8252\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/vmxnet3/vmxnet3_drv.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.265\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.216\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.183\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.148\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.101\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.42\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.6\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/2ddf51fcb6dd7d55ceef38e2e1a5ab2ab7fd47b0","https://git.kernel.org/stable/c/fbab6b73cc086e32698c86e43d1b16bf17d24c36","https://git.kernel.org/stable/c/28e382646417c7e2be9c9a7079eddf627ff52b90","https://git.kernel.org/stable/c/667b6e52048eaf4dbcf1707ed87ffd44abb9cb38","https://git.kernel.org/stable/c/28cb5d8d13b4c1faf3f688f62e5df82fe7b438d8","https://git.kernel.org/stable/c/4fdb0f162ccdbe9626863b10003855703253fa29","https://git.kernel.org/stable/c/b28596baf87e25a078789f1c05817c8a3bf71257","https://git.kernel.org/stable/c/34a71f5361fc3adb5b7138da78750b0d535a8252"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68299","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-68299","identifiers":["CVE-2026-68299"]},"retained":false,"historicalAffected":[]}],"coverage":[]}