An out‑of‑bounds memory read in the Linux kernel’s Geneve offload path allows an attacker to send crafted Geneve packets with an invalid GRO hint. The kernel incorrectly uses the hint unconditionally in geneve_gro_complete(), causing KASAN to report a slab out‑of‑bounds read in ipv6_gro_complete(). This read can corrupt kernel memory or lead to a crash, enabling potential privilege escalation or denial‑of‑service. The weakness is a classic buffer bounds error (CWE‑119).

The vulnerability affects the Linux kernel’s Geneve implementation. All kernel releases that include the unpatched geneve_gro_complete() code are vulnerable, with no specific version range provided in the CVE data. Users should check whether their distribution includes the recent kernel commit that gates the GRO hint in both receive and complete paths.

No EPSS score is available and the issue is not listed in the CISA KEV catalog. Despite the lack of a published CVSS score, the kernel OOB read is a high‑impact flaw that can be triggered via network traffic to an affected host. Attackers could likely craft a packet to exploit the hint and cause a kernel panic or arbitrary code execution, making the risk moderate to high until the kernel is patched. Network‑only attack vector is inferred from the nature of Geneve tunnels.