Cloudanix VulnDB

CVE-2026-68296

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A networking bug in Linux could cause systems using certain tunnel configurations to freeze under load, interrupting network services until the system is restarted.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Regression in GRE/GRETAP/ip6gre tunnel initialization moves dev->lltx assignment after SEQ/CSUM early returns, causing loss of lockless TX and re-acquisition of _xmit_lock around ndo_start_xmit; re-entry via ip_tunnel_xmit creates ABBA deadlock risk with underlay qdisc locks.

Why it matters to the business

Network instability or kernel deadlocks on systems using GRE tunnels with sequence numbering or checksums can lead to service outages and require reboots in virtualized or tunneled environments.

How an attack unfolds

An attacker or workload triggers concurrent transmissions on affected GRE tunnels; the resulting lock ordering violation between tunnel and underlay devices produces a deadlock without requiring external packets in many cases.

How to fix it

Apply the upstream fix that restores unconditional dev->lltx = true before the SEQ/CSUM early returns in __gre_tunnel_init and ip6gre_tnl_init_features; rebuild and deploy updated kernel packages.

How to confirm the fix worked

Inspect kernel source for the corrected placement of dev->lltx assignment, verify tunnel feature flags include lockless TX via ethtool, and confirm absence of deadlock symptoms under load after upgrade.

Typical attack path

  1. Configure or observe GRE tunnel with SEQ or CSUM+encap features enabled
  2. Generate concurrent transmit traffic that enters ip_tunnel_xmit while holding _xmit_lock
  3. Trigger lock contention with underlay device qdisc to induce ABBA deadlock

How to detect it

Review kernel logs for soft lockup or deadlock messages involving qdisc_xmit_lock or network transmit paths on systems with GRE tunnels; correlate with traffic patterns on tunnels using sequence or checksum features.

What your security team should do

  • Prioritize kernel updates on hosts using GRE tunnels with SEQ/CSUM
  • Audit network configurations to identify affected tunnel setups
  • Monitor for kernel lockup or soft lockup messages in system logs

The record

In the Linux kernel, the following vulnerability has been resolved: net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM Before commit 00d066a4d4ed ("netdev_features: convert NETIF_F_LLTX to dev->lltx"), NETIF_F_LLTX was set unconditionally in both __gre_tunnel_init() and ip6gre_tnl_init_features() alongside GRE_FEATURES: dev->features |= GRE_FEATURES | NETIF_F_LLTX; When that commit converted NETIF_F_LLTX to the dev->lltx flag, it placed 'dev->lltx = true' after the SEQ/CSUM early returns instead of before them. This causes GRE/GRETAP/ip6gre tunnels with SEQ or CSUM+encap to lose lockless TX, reintroducing _xmit_lock acquisition around their ndo_start_xmit. Since GRE xmit re-enters the stack via ip_tunnel_xmit(), holding _xmit_lock risks ABBA deadlock with the underlay device. CPU0 CPU1 ---- ---- lock(&qdisc_xmit_lock_key#6); lock(&qdisc_xmit_lock_key#3); lock(&qdisc_xmit_lock_key#6); lock(&qdisc_xmit_lock_key#3); Fix by moving dev->lltx = true before the early returns in both functions, restoring the original unconditional behavior.

Affected packages

Ecosystem Package Introduced Fixed