SB20260812238 - Always-Incorrect Control Flow Implementation in Linux kernel net vmxnet3 driver

Description

This security bulletin contains information about 1 vulnerability.

1) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68299)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of encapsulated packet headers in vmxnet3_get_hdr_len() when processing Geneve-encapsulated packets. A remote attacker can send a specially crafted packet to cause a denial of service.

The issue is triggered when descriptor fields describe the inner header instead of the outer header, including cases where the outer protocol is UDP or the outer and inner IP versions differ.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/28cb5d8d13b4c1faf3f688f62e5df82fe7b438d8
• https://git.kernel.org/stable/c/34a71f5361fc3adb5b7138da78750b0d535a8252
• https://git.kernel.org/stable/c/4fdb0f162ccdbe9626863b10003855703253fa29
• https://git.kernel.org/stable/c/667b6e52048eaf4dbcf1707ed87ffd44abb9cb38
• https://git.kernel.org/stable/c/b28596baf87e25a078789f1c05817c8a3bf71257