The Linux kernel geneve module had a vulnerability where geneve_gro_complete() independently re-derived the inner dispatch type and length from the packet and the current gro_hint, which could differ from geneve_gro_receive() due to concurrency or option byte differences. This discrepancy could cause geneve_gro_complete() to process beyond the validated inner network header offset, leading to out-of-bounds completion. The patch adds a validation step in geneve_gro_complete() to compute the offset it will dispatch at and bail out if this offset exceeds the inner_network_offset recorded by geneve_gro_receive(), using a lower bound comparison to account for inner VLAN tags.

The vulnerability could allow out-of-bounds packet processing within the geneve module of the Linux kernel, potentially leading to memory safety issues. However, no known exploits in the wild have been reported. The impact is limited to the geneve network encapsulation functionality in the kernel and could affect systems using this feature.

A fix has been implemented in the Linux kernel to validate the inner network offset in geneve_gro_complete(), preventing out-of-bounds processing. Users should apply the official kernel updates that include this patch. Since this is a kernel-level fix, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the vendor or kernel maintainers for the exact fixed versions and update accordingly.