CVE-2026-68299: Linux Kernel vmxnet3 DoS Vulnerability

CVE-2026-68299 Overview

CVE-2026-68299 is a Linux kernel vulnerability in the vmxnet3 network driver. The flaw resides in vmxnet3_get_hdr_len(), which incorrectly assumes the receive completion descriptor always describes the outer header of an incoming packet. For Geneve-encapsulated traffic, the vmxnet3 device can populate descriptor fields based on the inner header instead, signalled by the VMXNET3_RCD_HDR_INNER_SHIFT bit. This mismatch triggers BUG_ON() assertions, causing a kernel panic and denial of service on affected hosts. The issue affects Linux kernel builds shipping the vmxnet3 driver, typically Linux guests running on VMware hypervisors.

Critical Impact
A remote attacker able to deliver crafted Geneve-encapsulated packets to a vmxnet3 interface can trigger a kernel BUG_ON, resulting in system crash and denial of service.

Affected Products

Linux kernel vmxnet3 driver (paravirtualized VMware network adapter)
Linux guest virtual machines running on VMware ESXi with Geneve tunneling enabled
Distributions shipping affected kernel versions prior to the referenced stable patches

Discovery Timeline

2026-08-10 - CVE-2026-68299 published to the National Vulnerability Database
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68299

Vulnerability Analysis

The vulnerability lives in the vmxnet3_get_hdr_len() function of the Linux vmxnet3 driver. This function parses receive completion descriptors (gdesc->rcd) to compute header length for received packets. It reads the v4, v6, and tcp flag bits and assumes those bits describe the outermost L3/L4 headers of the frame.

When a Geneve tunnel is in use, the VMware virtual NIC can instead set those descriptor bits based on the inner encapsulated header. The driver does not check the VMXNET3_RCD_HDR_INNER_SHIFT bit that signals this behavior, so it parses the outer Ethernet and IP headers while trusting inner-header flags. Two BUG_ON() assertions then fire: BUG_ON(hdr.ipv4->protocol != IPPROTO_TCP) when the outer protocol is UDP (Geneve rides on UDP), and BUG_ON(hdr.eth->h_proto != ...) when the outer and inner IP versions differ, such as outer IPv6 with inner IPv4.

Root Cause

The root cause is a missing check for the VMXNET3_RCD_HDR_INNER_SHIFT completion descriptor bit combined with the use of BUG_ON() for input the driver cannot control. The function assumes descriptor flags always describe the outer header. For encapsulated packets this assumption breaks, and the defensive BUG_ON() macros escalate a driver logic error into a kernel panic.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker who can inject or route Geneve-encapsulated packets that reach a vmxnet3 interface, with mismatched outer and inner header characteristics, can trigger the assertion. The impact is confined to availability: the kernel crashes, but confidentiality and integrity are not affected.

No public proof-of-concept exploit code has been referenced in the advisory. Readers should consult the upstream stable commits linked in the Kernel Patch Commit 28cb5d8 and related fixes for the exact code paths modified.

Detection Methods for CVE-2026-68299

Indicators of Compromise

Unexpected kernel panics on Linux VMs running on VMware ESXi hosts, with stack traces referencing vmxnet3_get_hdr_len or vmxnet3_rq_rx_complete.
BUG_ON oops entries in dmesg or /var/log/kern.log mentioning IPPROTO or h_proto mismatches inside the vmxnet3 driver.
Repeated guest reboots correlating with inbound Geneve (UDP/6081) traffic from overlay networks.

Detection Strategies

Inspect kernel crash dumps and kdump output for the vmxnet3_get_hdr_len symbol in the panic backtrace.
Monitor virtualization platform logs for Linux guests that reboot shortly after receiving encapsulated traffic on tunneled overlay networks.
Correlate NetFlow or hypervisor packet captures with guest availability events to identify Geneve traffic patterns preceding crashes.

Monitoring Recommendations

Alert on Linux guest kernel oops events forwarded via syslog, filtering for the vmxnet3 driver namespace.
Track hypervisor-level UDP/6081 (Geneve) flows toward Linux VMs and baseline expected volumes.
Enable persistent kdump on production Linux VMs to preserve panic evidence for post-incident analysis.

How to Mitigate CVE-2026-68299

Immediate Actions Required

Identify Linux VMs running the vmxnet3 driver on VMware ESXi hosts, especially those attached to NSX or other Geneve-based overlay networks.
Apply vendor-supplied kernel updates that include the upstream fix as soon as they are available for your distribution.
Prioritize patching for internet-exposed workloads and multi-tenant hosts where untrusted Geneve traffic could reach guest NICs.

Patch Information

The fix adds an early check for VMXNET3_RCD_HDR_INNER_SHIFT and returns 0 when the driver cannot locate the inner header. The remaining BUG_ON() calls in the function are converted to defensive returns of 0. The upstream stable commits are 28cb5d8, 34a71f5, 4fdb0f1, 667b6e5, and b28596b, available from the kernel.org stable tree. Consult your distribution's advisories for backported package versions.

Workarounds

Where patching is not immediately possible, disable Geneve offload on affected interfaces using ethtool -K <iface> rx-gro-list off tx-udp_tnl-segmentation off tx-udp_tnl-csum-segmentation off.
Restrict Geneve (UDP/6081) traffic at the hypervisor or fabric layer so only trusted overlay endpoints can send encapsulated packets to Linux guests.
Consider migrating critical workloads to a non-vmxnet3 virtual NIC (for example, e1000e) until patched kernels are deployed.

bash

# Verify running kernel and vmxnet3 module version
uname -r
modinfo vmxnet3 | grep -E '^(version|srcversion|filename)'

# Disable UDP tunnel offloads as a temporary mitigation
ethtool -K eth0 tx-udp_tnl-segmentation off
ethtool -K eth0 tx-udp_tnl-csum-segmentation off