CVE-2026-23262 Overview
CVE-2026-23262 is a memory corruption vulnerability in the Linux kernel's Google Virtual Ethernet (gve) network driver. The flaw resides in the shared stats reporting region between the driver and the network interface controller (NIC). When the queue count is modified, the driver resizes its stats region while the NIC continues calculating offsets based on the previously communicated size. This mismatch causes the NIC to write past the allocated stats region, corrupting adjacent kernel memory. The vulnerability has been resolved through multiple stable kernel patches.
Critical Impact
Increasing queue counts on a gve-backed interface causes the NIC to write past the allocated stats region, resulting in kernel memory corruption and inaccurate stats reporting when counts decrease.
Affected Products
- Linux kernel versions containing the gve (Google Virtual Ethernet) driver
- Google Cloud Compute Engine virtual machines using gve networking
- Linux distributions shipping vulnerable kernel versions prior to the referenced stable patches
Discovery Timeline
- 2026-03-18 - CVE-2026-23262 published to NVD
- 2026-03-19 - Last updated in NVD database
Technical Details for CVE-2026-23262
Vulnerability Analysis
The gve driver and the NIC share a memory region used for stats reporting. The NIC calculates its offset into this region based on the total size of the stats region plus the size of the NIC's stats. When the driver changes the number of queues, it resizes its stats region without ensuring the NIC's offset calculation remains synchronized.
If the queue count is increased, the NIC writes its stats beyond the end of the newly allocated region. This out-of-bounds write corrupts kernel memory adjacent to the stats buffer. If the queue count is decreased, a gap forms between the driver's stats and where the NIC writes its stats, producing incorrect telemetry.
The fix allocates the stats region at its maximum supported size and aligns the offset calculation for NIC stats with the calculation performed by the NIC firmware.
Root Cause
The root cause is a synchronization flaw between driver-side memory allocation and NIC-side offset calculation [CWE-787 Out-of-bounds Write]. The driver dynamically sized the shared region using the current queue count, while the NIC computed its write offset using a fixed view of the region layout. Any reduction or expansion of queues invalidated the shared layout assumption.
Attack Vector
Triggering the condition requires a privileged local actor with the ability to change the queue count on a gve interface, typically through ethtool -L or equivalent netlink operations. On affected virtual machines, an administrative user reconfiguring receive or transmit queue counts triggers the out-of-bounds NIC write into kernel memory. The corruption is driven by the NIC hardware path rather than guest code, making the resulting state difficult to reason about. The vulnerability does not provide a direct remote attack surface based on the available data.
The vulnerability manifests in the gve driver's stats region allocation and offset reporting paths. See the referenced kernel commits for the exact code changes.
Detection Methods for CVE-2026-23262
Indicators of Compromise
- Unexplained kernel memory corruption messages, oops, or panics on hosts running the gve driver following queue count changes
- Inconsistent or zeroed NIC statistics in ethtool -S output after issuing ethtool -L
- Network instability or driver resets correlated with administrative queue reconfiguration events
Detection Strategies
- Inventory all Linux hosts using the gve driver and identify those running kernels prior to the patched stable releases referenced in the advisory
- Audit configuration management and orchestration tooling for invocations of ethtool -L or netlink set_channels calls against gve interfaces
- Correlate kernel ring buffer errors involving gve with recent queue count modifications using centralized log collection
Monitoring Recommendations
- Forward dmesg and /var/log/kern.log entries containing gve to a centralized SIEM for inspection
- Alert on changes to NIC queue configuration on production workloads, particularly in Google Cloud Compute Engine environments
- Track kernel package versions across the fleet and flag systems still running pre-patch builds
How to Mitigate CVE-2026-23262
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced for the gve driver and reboot affected systems
- Avoid changing gve queue counts on production systems until the patched kernel is deployed
- Restrict access to administrative network configuration tooling such as ethtool to authorized operators
Patch Information
The fix allocates the stats region using the maximum supported size and updates the NIC stats offset calculation to mirror the NIC's own computation. Patched commits are available in the upstream stable trees: Kernel Patch 11f8311f, Kernel Patch 7b9ebcc, Kernel Patch 837c662, Kernel Patch 9d93332, Kernel Patch 9fa0a75, Kernel Patch df54838, and Kernel Patch f432f76.
Workarounds
- Lock the queue count at boot time and prevent runtime modifications on hosts running unpatched kernels
- Limit CAP_NET_ADMIN to required administrative users to reduce the surface for triggering the condition
- Where supported by the workload, fall back to a non-gve interface model until kernels are updated
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
