The Linux kernel's geneve network tunneling implementation had a vulnerability where geneve_gro_complete() used an attacker-controlled GRO hint unconditionally, inflating header length and redirecting dispatch offsets without validation. This caused out-of-bounds reads in ipv6_gro_complete(), leading to a kernel slab-out-of-bounds error detected by KASAN. The root cause was a mismatch between geneve_gro_receive(), which only honors the GRO hint if enabled on the socket, and geneve_gro_complete(), which always acts on the hint. The fix gates geneve_gro_complete() on the same socket hint flag to ensure consistent behavior. Tunnels with the hint enabled were unaffected.

The vulnerability can cause out-of-bounds memory reads in kernel space, potentially leading to kernel crashes or memory corruption. This undermines kernel memory safety and could be leveraged for denial of service or other attacks depending on exploitability. However, no known exploits in the wild have been reported. Tunnels that enable the GRO hint are not affected.

A fix has been implemented in the Linux kernel to gate geneve_gro_complete() on the socket's GRO hint flag, ensuring consistent handling and preventing out-of-bounds reads. Users should update to a kernel version that includes this fix once available. Since no patch links or vendor advisories are provided, check the official Linux kernel release notes or vendor advisories for the patch status and apply updates accordingly.