The vmxnet3 virtual network adapter in the Linux kernel contains a BUG_ON assertion that incorrectly assumes the outer header of every packet is described by gdesc->rcd.v4/v6/tcp. This is a CWE‑617 flaw involving incorrect control flow. When a Geneve‑encapsulated packet is received, the device may set these fields to describe the inner header, which is signaled by the VMXNET3_RCD_HDR_INNER_SHIFT bit in the completion descriptor. Because the assertion checks for an outer TCP protocol, it fails – the outer protocol is UDP for Geneve – and the kernel panics, causing a system crash.

Linux hosts that use the vmxnet3 driver, typically virtual machines running on VMware or other environments that expose a vmxnet3 network interface, are impacted. Any kernel build prior to the commit that patches the driver contains the flaw. No specific kernel release is documented, so any vulnerable kernel version before the fix is affected.

The flaw only triggers when a specially crafted Geneve packet with UDP outer header is processed by the vmxnet3 driver. An attacker who can send such traffic can force a kernel panic, resulting in a denial‑of‑service. The CVSS score is 7.5, indicating moderate severity; the EPSS score is less than 1 %, showing a low likelihood of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires network access to send UDP Geneve traffic to the host.