CVE-2026-68129: Linux Kernel GVE Driver DOS Vulnerability

CVE-2026-68129 Overview

CVE-2026-68129 is a denial-of-service vulnerability in the Linux kernel's Google Virtual Ethernet (gve) driver. Under extreme memory pressure, page allocations can fail inside the Rx buffer refill loop. When the number of buffers posted to hardware falls below a critical threshold, the receive queue can enter a permanent stall state.

The stall becomes self-sustaining. The device drops incoming packets, no Rx completions are generated, and NAPI is never rescheduled to run the refill loop again. Network connectivity through the affected queue is lost until the interface is reset.

Critical Impact
A remote attacker can trigger sustained network denial of service against Linux systems using the gve driver by inducing memory pressure that halts packet reception on affected Rx queues.

Affected Products

Linux kernel with the Google Virtual Ethernet (gve) driver enabled
Google Cloud Compute Engine instances running affected Linux kernel versions
Virtualized workloads using the gve network driver on Google Cloud Platform

Discovery Timeline

2026-08-10 - CVE-2026-68129 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68129

Vulnerability Analysis

The vulnerability resides in the Rx buffer refill logic of the Linux gve driver. The driver relies on the NAPI polling mechanism to process received packets and replenish descriptors in the Rx ring. Under sustained memory pressure, page allocations inside the refill loop can fail, causing the loop to exit before restoring the ring above a safe operating threshold.

Once the descriptor count drops too low, three conditions combine to lock the queue. First, the device has no descriptors to place incoming packets into and drops them. Second, no completions are generated because no packets are processed. Third, NAPI is never rescheduled, so the refill loop never runs again even after system memory becomes available. This deadlock persists until the interface is administratively reset.

Root Cause

The root cause is a missing recovery path when page allocation failures occur during Rx buffer replenishment. The driver couples refill scheduling entirely to NAPI, and NAPI is triggered only by Rx completions. When completions stop, no mechanism exists to retry allocation once memory pressure subsides. This design creates a resource exhaustion condition classified as a Denial of Service vulnerability.

Attack Vector

An attacker with network reachability to the target can amplify the condition by generating traffic during memory pressure events. According to the CVSS vector, exploitation requires no privileges and no user interaction, and impacts availability only. The fix introduces a per-Rx-queue starvation recovery timer. When posted buffers fall below 32 (the size chosen to accommodate a full maximum-sized Receive Segment Coalescing packet consuming up to 19 descriptors), a timer periodically reschedules NAPI until the refill succeeds.

No public exploit code is available. Technical details for the fix are documented across five upstream commits, including Kernel Git Commit 1 and Kernel Git Commit 5.

Detection Methods for CVE-2026-68129

Indicators of Compromise

Sudden loss of ingress traffic on a gve-backed network interface with the link still reported as up
Kernel log entries indicating page allocation failures (order:0 allocation failures) correlated with network hangs
Rx queue counters (ethtool -S) showing static or stalled values while interface remains administratively up
Interface recovery only after link reset, driver reload, or instance reboot

Detection Strategies

Monitor /proc/net/dev and ethtool -S <iface> for Rx packet counters that stop incrementing while the interface is enabled
Alert on kernel messages containing page allocation failure combined with gve subsystem tags
Track memory pressure events (vmstat, /proc/pressure/memory) correlated with network throughput drops on Google Cloud VM instances

Monitoring Recommendations

Ingest kernel logs and network interface telemetry into a centralized platform to correlate memory pressure with queue stalls
Establish baseline Rx throughput for gve interfaces and alert on prolonged deviations
Track kernel version inventory across Linux fleets to identify hosts running unpatched gve driver code

How to Mitigate CVE-2026-68129

Immediate Actions Required

Identify Linux systems using the gve driver, particularly Google Cloud Compute Engine instances, and inventory their kernel versions
Apply the stable kernel updates containing the starvation recovery timer fix
Reduce sustained memory pressure on affected hosts through workload right-sizing or memory limits

Patch Information

The fix was merged upstream and backported to stable kernel branches. Review the five commits referenced in the NVD entry to determine the earliest fixed version for each maintained branch: Commit 0c317349, Commit 299d5728, Commit 689b9f58, Commit 91e0249f, and Commit b65352a1. Consult your Linux distribution vendor for backported kernel packages.

Workarounds

Configure aggressive memory reclaim tuning (vm.min_free_kbytes, vm.watermark_scale_factor) to reduce the likelihood of allocation failures on gve receive paths
Implement automated interface recovery scripts that detect stalled Rx counters and issue a link reset as a temporary measure
Right-size instances to avoid operating consistently near memory limits until patched kernels can be deployed

bash

# Check kernel version and gve driver status
uname -r
lsmod | grep gve
ethtool -i eth0 | grep driver

# Monitor for Rx queue stalls
watch -n 1 'ethtool -S eth0 | grep -E "rx_.*(packets|dropped|no_buffers)"'

# Tune memory watermarks to reduce allocation failure likelihood
sysctl -w vm.min_free_kbytes=131072
sysctl -w vm.watermark_scale_factor=200