{"id":"CVE-2026-68296","title":"net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gre: fix lltx regression for GRE tunnels with SEQ/CSUM\n\nBefore commit 00d066a4d4ed (\"netdev_features: convert NETIF_F_LLTX to\ndev->lltx\"), NETIF_F_LLTX was set unc…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 00d066a4d4edbe559ba6c35153da71d4b2b8a383 < 9f948e9aede9678f4103457daf2bc9dd54c65a06","Linux >= 00d066a4d4edbe559ba6c35153da71d4b2b8a383 < 15a1c5f2ed2eeb3daad8d5766fd506aeda4710f3","Linux >= 00d066a4d4edbe559ba6c35153da71d4b2b8a383 < 2bffe379023512d280337c70faeb6a8cc435db5e","Linux >= 00d066a4d4edbe559ba6c35153da71d4b2b8a383 < 675ed582c1aa4d919dd535490de08c015005c653","Linux 6.12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:46:40.818522Z"},"published":"2026-08-10","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:55:12.210Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68296","references":[{"url":"https://git.kernel.org/stable/c/9f948e9aede9678f4103457daf2bc9dd54c65a06"},{"url":"https://git.kernel.org/stable/c/15a1c5f2ed2eeb3daad8d5766fd506aeda4710f3"},{"url":"https://git.kernel.org/stable/c/2bffe379023512d280337c70faeb6a8cc435db5e"},{"url":"https://git.kernel.org/stable/c/675ed582c1aa4d919dd535490de08c015005c653"}],"tags":["cve.org"],"epss":0.00206,"epssPercentile":0.10635,"ingestedAt":"2026-11-06T18:00:12.614Z","slug":"CVE-2026-68296","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: gre: fix lltx regression for GRE tunnels with SEQ/CSUM\n\nBefore commit 00d066a4d4ed (\"netdev_features: convert NETIF_F_LLTX to\ndev->lltx\"), NETIF_F_LLTX was set unconditionally in both\n__gre_tunnel_init() and ip6gre_tnl_init_features() alongside\nGRE_FEATURES:\n\n    dev->features |= GRE_FEATURES | NETIF_F_LLTX;\n\nWhen that commit converted NETIF_F_LLTX to the dev->lltx flag, it\nplaced 'dev->lltx = true' after the SEQ/CSUM early returns instead\nof before them. This causes GRE/GRETAP/ip6gre tunnels with SEQ or\nCSUM+encap to lose lockless TX, reintroducing _xmit_lock acquisition\naround their ndo_start_xmit. Since GRE xmit re-enters the stack via\nip_tunnel_xmit(), holding _xmit_lock risks ABBA deadlock with the\nunderlay device.\n\n  CPU0                        CPU1\n  ----                        ----\n  lock(&qdisc_xmit_lock_key#6);\n                              lock(&qdisc_xmit_lock_key#3);\n                              lock(&qdisc_xmit_lock_key#6);\n  lock(&qdisc_xmit_lock_key#3);\n\nFix by moving dev->lltx = true before the early returns in both\nfunctions, restoring the original unconditional behavior.\n\n## Affected\n\n- `Linux >= 00d066a4d4edbe559ba6c35153da71d4b2b8a383 < 9f948e9aede9678f4103457daf2bc9dd54c65a06`\n- `Linux >= 00d066a4d4edbe559ba6c35153da71d4b2b8a383 < 15a1c5f2ed2eeb3daad8d5766fd506aeda4710f3`\n- `Linux >= 00d066a4d4edbe559ba6c35153da71d4b2b8a383 < 2bffe379023512d280337c70faeb6a8cc435db5e`\n- `Linux >= 00d066a4d4edbe559ba6c35153da71d4b2b8a383 < 675ed582c1aa4d919dd535490de08c015005c653`\n- `Linux 6.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}