SB20260816488 - Out-of-bounds write in Linux kernel google gve driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-72046)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in the gve DQO RX header buffer handling when processing out-of-order RX completions with header-split and HW-GRO enabled. A local user can trigger packet flows that cause header buffer reuse while still owned by the device to cause a denial of service.

Exploitation requires header-split and HW-GRO to be enabled, and completion reordering can occur with multiple interleaved flows.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/35267819b25074084130b6a7be18bbaf44d3ae74
• https://git.kernel.org/stable/c/84d3753d4bf284ef770ead6dee2270aaabb3ef41
• https://git.kernel.org/stable/c/9f8e7f59b0c2f466be74bd923726b0f5496c27ad
• https://git.kernel.org/stable/c/d676c9a73bdcd8237425dbb826f2bd1a25c36e40