CVE-2026-68296: Linux Kernel GRE Tunnel DoS Vulnerability

CVE-2026-68296 Overview

CVE-2026-68296 is a Linux kernel networking regression affecting Generic Routing Encapsulation (GRE) tunnels configured with sequence numbers (SEQ) or checksums plus encapsulation (CSUM+encap). The regression was introduced by commit 00d066a4d4ed ("netdev_features: convert NETIF_F_LLTX to dev->lltx"), which placed the dev->lltx = true assignment after the SEQ/CSUM early returns in __gre_tunnel_init() and ip6gre_tnl_init_features(). As a result, GRE, GRETAP, and ip6gre tunnels lose lockless transmit (LLTX) behavior. The kernel reacquires _xmit_lock around ndo_start_xmit, creating an ABBA deadlock risk when GRE transmit re-enters the stack through ip_tunnel_xmit().

Critical Impact
Concurrent transmit paths across the GRE tunnel and its underlay device can deadlock, halting network traffic on affected kernels.

Affected Products

Linux kernel versions containing commit 00d066a4d4ed prior to the fix
GRE, GRETAP, and ip6gre tunnel interfaces configured with SEQ or CSUM+encap
Systems relying on stacked tunnel and underlay device transmit paths

Discovery Timeline

2026-08-10 - CVE-2026-68296 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68296

Vulnerability Analysis

The regression sits in the GRE tunnel initialization logic within the Linux networking stack. Before the offending commit, both __gre_tunnel_init() and ip6gre_tnl_init_features() unconditionally set NETIF_F_LLTX alongside GRE_FEATURES using dev->features |= GRE_FEATURES | NETIF_F_LLTX;. This guaranteed lockless transmit for every GRE tunnel variant regardless of SEQ or CSUM configuration.

When commit 00d066a4d4ed migrated the feature flag to the dedicated dev->lltx boolean, the assignment moved to a code path that executes after early returns triggered by SEQ or CSUM+encap configurations. Tunnels using those options never reach the assignment and lose lockless transmit behavior. The kernel then acquires _xmit_lock around each ndo_start_xmit call.

Root Cause

The root cause is incorrect placement of dev->lltx = true relative to the SEQ/CSUM early-return branches in the two initialization functions. This is a kernel driver logic error [CWE-667-adjacent locking issue] introduced during a feature-flag refactor.

Attack Vector

This is not a remote exploitation vector but a stability and availability defect. Because GRE transmit re-enters the stack via ip_tunnel_xmit(), holding _xmit_lock on the tunnel while the underlay device also acquires its own _xmit_lock produces an ABBA lock ordering pattern. The commit message documents the following deadlock scenario:

CPU0                        CPU1
----                        ----
lock(&qdisc_xmit_lock_key#6);
                            lock(&qdisc_xmit_lock_key#3);
                            lock(&qdisc_xmit_lock_key#6);
lock(&qdisc_xmit_lock_key#3);

A workload that transmits concurrently through a GRE tunnel and its underlay device can trigger the deadlock, stalling network I/O on affected CPUs.

Detection Methods for CVE-2026-68296

Indicators of Compromise

Kernel lockdep warnings citing qdisc_xmit_lock_key in an ABBA pattern involving a GRE, GRETAP, or ip6gre device
Hung task or soft lockup traces referencing ip_tunnel_xmit, gre_xmit, or ip6gre_tunnel_xmit
Sudden loss of throughput on GRE tunnels configured with seq or csum options after a kernel update

Detection Strategies

Inventory Linux hosts running kernels built between commit 00d066a4d4ed and the fix commits 15a1c5f2ed2e, 2bffe3790235, 675ed582c1aa, and 9f948e9aede9
Query tunnel configurations with ip -d link show type gre, type gretap, and type ip6gre, filtering for seq or csum flags
Correlate kernel ring buffer messages (dmesg) for lockdep splats matching the documented ABBA pattern

Monitoring Recommendations

Forward kernel logs into a centralized analytics platform and alert on lockdep and soft-lockup signatures involving tunnel devices
Track network interface counters and qdisc drops on tunnels to detect stalls before user-visible impact
Include kernel version and tunnel feature inventory in configuration management baselines

How to Mitigate CVE-2026-68296

Immediate Actions Required

Apply the upstream fix that moves dev->lltx = true before the SEQ/CSUM early returns in __gre_tunnel_init() and ip6gre_tnl_init_features()
Identify tunnels using seq or csum options and schedule kernel updates on those hosts first
Restart affected tunnel interfaces after patching to ensure feature flags are re-initialized

Patch Information

The fix is available in the stable kernel tree through the following commits: Kernel Git Commit Update, Kernel Git Commit Fix, Kernel Git Commit Security, and Kernel Git Commit Analysis. Rebuild affected kernels or install the corresponding distribution updates.

Workarounds

Remove seq and csum options from GRE tunnel configurations where operationally acceptable
Avoid stacking GRE tunnels on underlay devices that share the same qdisc lock class until patched
Downgrade to a kernel predating commit 00d066a4d4ed if patching is not immediately feasible

bash

# Recreate a GRE tunnel without seq/csum as a temporary workaround
ip link set gre1 down
ip tunnel del gre1
ip tunnel add gre1 mode gre remote 203.0.113.10 local 198.51.100.20 ttl 64
ip link set gre1 up