CVE-2026-68299

What it actually does

The vmxnet3_get_hdr_len() function assumes completion descriptor fields always reference the outer packet header; Geneve encapsulation can cause the device to set VMXNET3_RCD_HDR_INNER_SHIFT, making the fields point at an inner header instead. This produces mismatched protocol and ethertype values that trigger BUG_ON assertions when the outer header is UDP (Geneve) or when outer/inner IP versions differ.

Why it matters to the business

Virtual machines using the vmxnet3 paravirtual NIC with Geneve overlays can experience sudden kernel panics and reboots when receiving certain encapsulated packets, leading to unplanned downtime and service interruption.

How an attack unfolds

An attacker with the ability to inject or reflect Geneve-encapsulated traffic toward a vulnerable vmxnet3 interface crafts packets whose inner-header properties differ from the outer tunnel header. When the device signals the inner-header bit, the driver hits the BUG_ON checks and panics the guest kernel.

How to fix it

Update the Linux kernel to a version containing the referenced fix that checks VMXNET3_RCD_HDR_INNER_SHIFT early and replaces remaining BUG_ON calls with safe return-0 behavior.

How to confirm the fix worked

Confirm the presence of the upstream commit that adds the VMXNET3_RCD_HDR_INNER_SHIFT guard and converts BUG_ON statements to defensive returns; test with Geneve traffic that previously triggered the assertions.

Typical attack path

1. Identify or compromise a path that can deliver Geneve-encapsulated frames to the target VM.
2. Send or reflect a Geneve packet whose inner L3/L4 headers differ in protocol or IP version from the outer headers.
3. Trigger the vmxnet3 completion path that sets VMXNET3_RCD_HDR_INNER_SHIFT.
4. Cause vmxnet3_get_hdr_len() to evaluate the mismatched header fields and hit a BUG_ON assertion.

How to detect it

Review kernel logs for vmxnet3 BUG_ON messages referencing hdr.ipv4->protocol or eth->h_proto during Geneve traffic handling; correlate with network flows containing Geneve UDP encapsulation.

What your security team should do

• Prioritize kernel updates for any hosts or guests running vmxnet3 with Geneve overlays.
• Monitor upstream stable and distribution kernels for the fix and schedule patching within normal change windows given low EPSS.
• Consider temporarily disabling Geneve offloads or switching to an alternative vNIC type if immediate patching is not feasible.