External risk intelligence

Linux Kernel Geneve GRO Hint Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-72408

The vulnerability exists in the Linux kernel GENEVE tunnel implementation. While network-accessible in specific tunnel-enabled infrastructure, GENEVE endpoints are typically internal network components, encapsulated services, or data center fabric elements not directly exposed to the public internet.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's GENEVE network component could allow an attacker to cause a system crash by sending specially crafted network traffic. This issue stems from how the kernel handles aggregated network frames within GENEVE tunnels, potentially leading to out-of-bounds reads when certain configurations are not properly honored.

Kernel bug affects network traffic aggregation.
Critical bug could cause system crashes.
Confirm if GENEVE tunnels are in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network packets to a Linux system running a vulnerable kernel. If the system is configured to use GENEVE tunnels with a disabled GRO hint, the kernel's packet processing logic could be tricked into reading beyond the allocated memory buffer. This memory corruption could lead to a system crash or potentially allow an attacker to execute arbitrary code with kernel privileges.

Requires network access to vulnerable system.
Triggered by specially crafted GENEVE packets.
Risk of system crash or code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's GENEVE networking component could allow an attacker to cause a denial-of-service condition. When a GENEVE tunnel is configured without a specific hint option, an attacker could send specially crafted packets that trigger an out-of-bounds read within the kernel, leading to a crash. This condition is supported when the affected socket has the IFLA_GENEVE_GRO_HINT feature disabled.

Kernel memory corruption.
Specially crafted packets.
System instability or crash.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's GENEVE implementation likely impacts infrastructure or platform teams responsible for network virtualization and kernel management. The first step is to identify systems utilizing GENEVE, confirm their exposure and criticality, and then engage the accountable owner to plan remediation.

Identify responsible infrastructure or platform teams.
Verify GENEVE tunnel reachability and criticality.
Plan kernel updates or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel GENEVE component?

GENEVE (Generic Network Virtualization Encapsulation) is a tunneling protocol used in Linux to create virtual networks. It allows infrastructure to wrap network traffic within other packets, which is essential for modern cloud environments, data center fabric, and software-defined networking to maintain isolated traffic flows between virtual machines or containers.

What does CVE-2026-72408 mean?

This is an out-of-bounds memory read vulnerability in the kernel's network stack. The weakness class involves improper input validation during the Generic Receive Offload (GRO) process. The kernel fails to correctly check if a GENEVE tunnel is configured to accept specific hints, allowing a crafted packet to trick the system into reading memory outside of allocated bounds.

How is this vulnerability triggered?

An attacker must send specifically formatted network packets to a Linux system using GENEVE tunnels. The bug triggers only when the tunnel is configured with the GRO hint feature disabled. If a tunnel has this hint enabled, the kernel logic correctly validates the packet headers, and the vulnerability is not triggered.

Do I need to worry about this vulnerability?

Halo Surface Signal assesses the risk for this component as Unlikely, because GENEVE endpoints are typically internal infrastructure components rather than services directly exposed to the public internet. You should focus on systems where GENEVE is actively used for internal network traffic or data center fabric, as these represent the primary scope for potential interaction.

What are the first steps to address this?

Your priority is to inventory your Linux systems to identify where GENEVE tunnels are configured. Once identified, consult your infrastructure or platform teams to assess if these tunnels operate with the GRO hint feature disabled. Finally, plan for kernel updates provided by your distribution vendor, as this is a core component issue requiring a patched kernel.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.