CVE-2026-68299
Detail
Received This CVE record has recently been published to the CVE List and has been included within the NVD dataset.
Description
In the Linux kernel, the following vulnerability has been resolved:
vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
vmxnet3_get_hdr_len() assumes gdesc->rcd.v4/v6/tcp always describe the
outer header, but for a Geneve-encapsulated packet the device can set
them based on the inner header instead, signalled by the
VMXNET3_RCD_HDR_INNER_SHIFT bit in the completion descriptor. Since the
function never skips the outer encapsulation, this mismatch triggers:
- BUG_ON(hdr.ipv4->protocol != IPPROTO_TCP), because the outer
protocol is UDP (Geneve), not TCP.
- BUG_ON(hdr.eth->h_proto != ...), when the tunnel's outer and inner
IP versions differ (e.g. outer IPv6/inner IPv4 or vice versa).
Check VMXNET3_RCD_HDR_INNER_SHIFT up front and bail out, since the
function cannot locate the inner header it would need to parse. Also
convert the remaining BUG_ON()s in this function to return 0
defensively.
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 4.0 Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 3.x Severity and Vector Strings:
NVD assessment
not yet provided.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 Severity and Vector Strings:
NVD assessment
not yet provided.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected]
Change History
4 change records found show changes
CVE Modified by kernel.org
8/19/2026 1:20:41 PM
Action
Type
Old Value
New Value
Added
Reference
https://git.kernel.org/stable/c/28e382646417c7e2be9c9a7079eddf627ff52b90
Added
Reference
https://git.kernel.org/stable/c/2ddf51fcb6dd7d55ceef38e2e1a5ab2ab7fd47b0
Added
Reference
https://git.kernel.org/stable/c/fbab6b73cc086e32698c86e43d1b16bf17d24c36
Changed
Affected
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/vmxnet3/vmxnet3_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"667b6e52048eaf4dbcf1707ed87ffd44abb9cb38","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"28cb5d8d13b4c1faf3f688f62e5df82fe7b438d8","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"4fdb0f162ccdbe9626863b10003855703253fa29","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"b28596baf87e25a078789f1c05817c8a3bf71257","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"34a71f5361fc3adb5b7138da78750b0d535a8252","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/vmxnet3/vmxnet3_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.2","status":"affected"},{"version":"0","lessThan":"4.2","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
Record truncated, showing 2048 of 2477 characters.
View Entire Change Record [{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/vmxnet3/vmxnet3_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"2ddf51fcb6dd7d55ceef38e2e1a5ab2ab7fd47b0","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"fbab6b73cc086e32698c86e43d1b16bf17d24c36","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"28e382646417c7e2be9c9a7079eddf627ff52b90","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"667b6e52048eaf4dbcf1707ed87ffd44abb9cb38","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"28cb5d8d13b4c1faf3f688f62e5df82fe7b438d8","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"4fdb0f162ccdbe9626863b10003855703253fa29","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"b28596baf87e25a078789f1c05817c8a3bf71257","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"34a71f5361fc3adb5b7138da78750b0d535a8252","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/vmxnet3/vmxnet3_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.2","status":"affected"},{"version":"0","lessThan":"4.2","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","
CVE Modified by kernel.org
8/17/2026 1:18:32 AM
Action
Type
Old Value
New Value
Changed
Affected
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/vmxnet3/vmxnet3_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"667b6e52048eaf4dbcf1707ed87ffd44abb9cb38","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"28cb5d8d13b4c1faf3f688f62e5df82fe7b438d8","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"4fdb0f162ccdbe9626863b10003855703253fa29","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"b28596baf87e25a078789f1c05817c8a3bf71257","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"34a71f5361fc3adb5b7138da78750b0d535a8252","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/vmxnet3/vmxnet3_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.2","status":"affected"},{"version":"0","lessThan":"4.2","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc5","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/vmxnet3/vmxnet3_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"667b6e52048eaf4dbcf1707ed87ffd44abb9cb38","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"28cb5d8d13b4c1faf3f688f62e5df82fe7b438d8","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"4fdb0f162ccdbe9626863b10003855703253fa29","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"b28596baf87e25a078789f1c05817c8a3bf71257","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"34a71f5361fc3adb5b7138da78750b0d535a8252","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/vmxnet3/vmxnet3_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.2","status":"affected"},{"version":"0","lessThan":"4.2","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
CVE Modified by kernel.org
8/13/2026 7:17:29 PM
Action
Type
Old Value
New Value
Added
CVSS V3.1
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
New CVE Received from kernel.org
8/10/2026 9:20:19 AM
Action
Type
Old Value
New Value
Added
Description
In the Linux kernel, the following vulnerability has been resolved:
vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
vmxnet3_get_hdr_len() assumes gdesc->rcd.v4/v6/tcp always describe the
outer header, but for a Geneve-encapsulated packet the device can set
them based on the inner header instead, signalled by the
VMXNET3_RCD_HDR_INNER_SHIFT bit in the completion descriptor. Since the
function never skips the outer encapsulation, this mismatch triggers:
- BUG_ON(hdr.ipv4->protocol != IPPROTO_TCP), because the outer
protocol is UDP (Geneve), not TCP.
- BUG_ON(hdr.eth->h_proto != ...), when the tunnel's outer and inner
IP versions differ (e.g. outer IPv6/inner IPv4 or vice versa).
Check VMXNET3_RCD_HDR_INNER_SHIFT up front and bail out, since the
function cannot locate the inner header it would need to parse. Also
convert the remaining BUG_ON()s in this function to return 0
defensively.
Added
Reference
https://git.kernel.org/stable/c/28cb5d8d13b4c1faf3f688f62e5df82fe7b438d8
Added
Reference
https://git.kernel.org/stable/c/34a71f5361fc3adb5b7138da78750b0d535a8252
Added
Reference
https://git.kernel.org/stable/c/4fdb0f162ccdbe9626863b10003855703253fa29
Added
Reference
https://git.kernel.org/stable/c/667b6e52048eaf4dbcf1707ed87ffd44abb9cb38
Added
Reference
https://git.kernel.org/stable/c/b28596baf87e25a078789f1c05817c8a3bf71257
Added
Affected
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/vmxnet3/vmxnet3_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"667b6e52048eaf4dbcf1707ed87ffd44abb9cb38","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"28cb5d8d13b4c1faf3f688f62e5df82fe7b438d8","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"4fdb0f162ccdbe9626863b10003855703253fa29","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"b28596baf87e25a078789f1c05817c8a3bf71257","versionType":"git","status":"affected"},{"version":"45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc","lessThan":"34a71f5361fc3adb5b7138da78750b0d535a8252","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/vmxnet3/vmxnet3_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.2","status":"affected"},{"version":"0","lessThan":"4.2","versionType":"semver","status":"unaffected"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc5","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
Quick Info
CVE Dictionary Entry: CVE-2026-68299 NVD
Published Date: 08/10/2026 NVD
Last Modified: 08/19/2026
Source: kernel.org
) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
