An out-of-bounds memory read in the Linux kernel’s Geneve offload path allows an attacker to send crafted Geneve packets with an invalid GRO hint. The kernel incorrectly uses the hint unconditionally in geneve_gro_complete(), causing KASAN to report a slab out-of-bounds read in ipv6_gro_complete(). This read can corrupt kernel memory or lead to a crash, enabling potential privilege escalation or denial-of-service.

The vulnerability affects the Linux kernel’s Geneve implementation. All kernel releases that include the unpatched geneve_gro_complete() code are vulnerable, with no specific version range provided in the CVE data. Users should check whether their distribution includes the recent kernel commit that gates the GRO hint in both receive and complete paths.

With a CVSS score of 10, the kernel out-of-bounds read represents a critical flaw that can be triggered via network traffic to an affected host. The EPSS score of < 1% indicates a low probability of exploitation in the wild, yet the impact remains high should an attacker discover a usable vector. Attackers could craft a packet to exploit the hint and cause a kernel panic or arbitrary code execution, leading to possible privilege escalation or denial of service. Geneve traffic is typically carried over UDP, and the attack vector would be network-based, allowing any reachable host running an affected kernel to be targeted. The risk of a successful exploit remains low to moderate until the kernel is patched.