---
id: CVE-2026-68296
title: 'net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM

  Before commit 00d066a4d4ed ("netdev_features: convert NETIF_F_LLTX to
  dev->lltx"), NETIF_F_LLTX was set unc…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 00d066a4d4edbe559ba6c35153da71d4b2b8a383 <
    9f948e9aede9678f4103457daf2bc9dd54c65a06
  - >-
    Linux >= 00d066a4d4edbe559ba6c35153da71d4b2b8a383 <
    15a1c5f2ed2eeb3daad8d5766fd506aeda4710f3
  - >-
    Linux >= 00d066a4d4edbe559ba6c35153da71d4b2b8a383 <
    2bffe379023512d280337c70faeb6a8cc435db5e
  - >-
    Linux >= 00d066a4d4edbe559ba6c35153da71d4b2b8a383 <
    675ed582c1aa4d919dd535490de08c015005c653
  - Linux 6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:46:40.818522Z'
published: '2026-08-10'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:55:12.210Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68296'
references:
  - url: 'https://git.kernel.org/stable/c/9f948e9aede9678f4103457daf2bc9dd54c65a06'
  - url: 'https://git.kernel.org/stable/c/15a1c5f2ed2eeb3daad8d5766fd506aeda4710f3'
  - url: 'https://git.kernel.org/stable/c/2bffe379023512d280337c70faeb6a8cc435db5e'
  - url: 'https://git.kernel.org/stable/c/675ed582c1aa4d919dd535490de08c015005c653'
tags:
  - cve.org
epss: 0.00206
epssPercentile: 0.10635
ingestedAt: '2026-11-06T18:00:12.614Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM

Before commit 00d066a4d4ed ("netdev_features: convert NETIF_F_LLTX to
dev->lltx"), NETIF_F_LLTX was set unconditionally in both
__gre_tunnel_init() and ip6gre_tnl_init_features() alongside
GRE_FEATURES:

    dev->features |= GRE_FEATURES | NETIF_F_LLTX;

When that commit converted NETIF_F_LLTX to the dev->lltx flag, it
placed 'dev->lltx = true' after the SEQ/CSUM early returns instead
of before them. This causes GRE/GRETAP/ip6gre tunnels with SEQ or
CSUM+encap to lose lockless TX, reintroducing _xmit_lock acquisition
around their ndo_start_xmit. Since GRE xmit re-enters the stack via
ip_tunnel_xmit(), holding _xmit_lock risks ABBA deadlock with the
underlay device.

  CPU0                        CPU1
  ----                        ----
  lock(&qdisc_xmit_lock_key#6);
                              lock(&qdisc_xmit_lock_key#3);
                              lock(&qdisc_xmit_lock_key#6);
  lock(&qdisc_xmit_lock_key#3);

Fix by moving dev->lltx = true before the early returns in both
functions, restoring the original unconditional behavior.

## Affected

- `Linux >= 00d066a4d4edbe559ba6c35153da71d4b2b8a383 < 9f948e9aede9678f4103457daf2bc9dd54c65a06`
- `Linux >= 00d066a4d4edbe559ba6c35153da71d4b2b8a383 < 15a1c5f2ed2eeb3daad8d5766fd506aeda4710f3`
- `Linux >= 00d066a4d4edbe559ba6c35153da71d4b2b8a383 < 2bffe379023512d280337c70faeb6a8cc435db5e`
- `Linux >= 00d066a4d4edbe559ba6c35153da71d4b2b8a383 < 675ed582c1aa4d919dd535490de08c015005c653`
- `Linux 6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.