CVE-2026-72407
Analyse NVD en cours
In the Linux kernel, the following vulnerability has been resolved: geneve: validate inner network offset in geneve_gro_complete() Even with both paths gated on gs->gro_hint, geneve_gro_complete() re-derives the inner dispatch type and length from the packet and the current gs->gro_hint, independently of geneve_gro_receive(). The two can disagree if gs->gro_hint flips under a concurrent geneve_quiesce()/ geneve_unquiesce() (sk_user_data is NULL across a synchronize_net()), or if the re-read option bytes differ from the ones receive parsed. geneve_gro_receive() already records the inner network header position in NAPI_GRO_CB()->inner_network_offset. Have geneve_gro_complete() compute the offset it is about to dispatch at, adding ETH_HLEN in the ETH_P_TEB case where eth_gro_complete() steps over the inner MAC header, and bail out if it lands past inner_network_offset. Use a lower bound rather than exact equality: between gh_len and the inner L3 header, geneve_gro_receive() may also have pulled an inner VLAN tag (vlan_gro_receive() advances the recorded offset past it), which only moves inner_network_offset further out. A valid frame therefore always satisfies inner_nh <= inner_network_offset, while a gh_len inflated by a hint gro_receive() did not honour dispatches past the validated inner header, i.e. the out-of-bounds completion. Only the latter is rejected.
Ce que ça veut dire
- Exposition
- Exploitable à distance depuis le réseau, sans authentification et sans action de la victime.
- Impact
- Un attaquant peut lire des données sensibles, modifier ou détruire des données et mettre le service hors ligne. L’atteinte déborde du composant vulnérable vers d’autres parties du système.
- Probabilité
- Le score EPSS reste bas : rien n’annonce une exploitation imminente, ce qui ne dispense pas de corriger.
À faireÀ corriger sans attendre le prochain cycle de correctifs. Commencer par les instances exposées à Internet.
Lecture automatique du vecteur CVSS, du type de faiblesse (CWE) et du score EPSS. La description technique ci-dessus reste celle publiée par le NIST, en anglais.