The Linux kernel’s Geneve implementation contains an incorrect validation of the inner network header offset in the geneve_gro_complete() routine. When a packet arrives the code recomputes the dispatch offset independently of the original receive path. If the gro hint flips during a concurrent quiesce/unquiesce cycle or if the re‑read option bytes differ, the two offsets can diverge. The routine accepts an offset that lies past the real inner header, allowing an attacker to craft a packet that causes the kernel to access memory beyond the bounds of the Geneve payload. This out‑of‑bounds completion can corrupt kernel memory, which is a flaw classified as CWE‑823, indicating improper handling of memory that can lead to arbitrary code execution or denial of service.

The bug resides in the generic Linux kernel stack, affecting any distribution that ships a kernel containing the legacy geneve_gro_complete() implementation. No specific release dates or version numbers were disclosed, so devices running non‑patched kernels that enable Geneve tunneling are potentially vulnerable. The advisory references the Linux kernel repository, indicating that the fix is available in the mainline code and should be present in recent stable releases.

The CVSS score of 10 indicates the highest severity, while the EPSS score of <1% implies a very low exploitation probability. The flaw is not listed in the CISA KEV catalog, implying that it may not yet have active exploits in the wild. An attacker might gain code execution by targeting the host’s Geneve traffic, so the attack vector is network‑based and requires the target to process Geneve packets.