The vmxnet3 virtual network adapter in the Linux kernel contains a BUG_ON assertion that incorrectly assumes the outer header of every packet is described by gdesc->rcd.v4/v6/tcp. This flaw is a CWE‑20 issue involving improper input validation, and also raises CWE‑617 concerns. When a Geneve‑encapsulated packet is received, the device may set these fields to describe the inner header, indicated by the VMXNET3_RCD_HDR_INNER_SHIFT bit in the completion descriptor. Because the assertion checks for an outer TCP protocol, it fails – the outer protocol is UDP for Geneve – and the kernel panics, causing a system crash.

Linux hosts that use the vmxnet3 driver are impacted. Any kernel build before the commit that patches the driver contains the flaw. No specific kernel release is documented, so any vulnerable kernel version before the fix is affected.

Based on the description, the flaw only triggers when a specially crafted Geneve packet is received by the vmxnet3 driver. It is inferred that an attacker who can send such traffic can force a kernel panic, causing a denial‑of‑service. The CVSS score is 7.5, indicating moderate severity; the EPSS score is less than 1 %, suggesting a low likelihood of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires network access to send UDP Geneve traffic to the host, which is the likely attack vector.