{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"9f948e9aede9678f4103457daf2bc9dd54c65a06","status":"affected","version":"00d066a4d4edbe559ba6c35153da71d4b2b8a383","versionType":"git"},{"lessThan":"15a1c5f2ed2eeb3daad8d5766fd506aeda4710f3","status":"affected","version":"00d066a4d4edbe559ba6c35153da71d4b2b8a383","versionType":"git"},{"lessThan":"2bffe379023512d280337c70faeb6a8cc435db5e","status":"affected","version":"00d066a4d4edbe559ba6c35153da71d4b2b8a383","versionType":"git"},{"lessThan":"675ed582c1aa4d919dd535490de08c015005c653","status":"affected","version":"00d066a4d4edbe559ba6c35153da71d4b2b8a383","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2026-68296","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gre: fix lltx regression for GRE tunnels with SEQ/CSUM\n\nBefore commit 00d066a4d4ed (\"netdev_features: convert NETIF_F_LLTX to\ndev->lltx\"), NETIF_F_LLTX was set unconditionally in both\n__gre_tunnel_init() and ip6gre_tnl_init_features() alongside\nGRE_FEATURES:\n\n    dev->features |= GRE_FEATURES | NETIF_F_LLTX;\n\nWhen that commit converted NETIF_F_LLTX to the dev->lltx flag, it\nplaced 'dev->lltx = true' after the SEQ/CSUM early returns instead\nof before them. This causes GRE/GRETAP/ip6gre tunnels with SEQ or\nCSUM+encap to lose lockless TX, reintroducing _xmit_lock acquisition\naround their ndo_start_xmit. Since GRE xmit re-enters the stack via\nip_tunnel_xmit(), holding _xmit_lock risks ABBA deadlock with the\nunderlay device.\n\n  CPU0                        CPU1\n  ----                        ----\n  lock(&qdisc_xmit_lock_key#6);\n                              lock(&qdisc_xmit_lock_key#3);\n                              lock(&qdisc_xmit_lock_key#6);\n  lock(&qdisc_xmit_lock_key#3);\n\nFix by moving dev->lltx = true before the early returns in both\nfunctions, restoring the original unconditional behavior.","epss":{"date":"2026-11-06","percentile":0.10635,"score":0.00206},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793985568030,"publishedAt":1786363349464,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/9f948e9aede9678f4103457daf2bc9dd54c65a06"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/15a1c5f2ed2eeb3daad8d5766fd506aeda4710f3"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/2bffe379023512d280337c70faeb6a8cc435db5e"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/675ed582c1aa4d919dd535490de08c015005c653"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/15a1c5f2ed2eeb3daad8d5766fd506aeda4710f3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/2bffe379023512d280337c70faeb6a8cc435db5e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/675ed582c1aa4d919dd535490de08c015005c653"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/9f948e9aede9678f4103457daf2bc9dd54c65a06"}],"remediation":[],"revision":"fd3e259e0aed914f51dd63bf232caff30e1cd2ee55f96943f880c345b85e1f34","sources":[{"modifiedAt":1793984112210,"name":"CNA: Linux","retrievedAt":1793985961868,"url":"https://www.cve.org/CVERecord?id=CVE-2026-68296"},{"modifiedAt":1793985568030,"name":"NVD","retrievedAt":1793989631007,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68296"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793986001418,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-68296"}],"ssvc":{"assessedAt":1793983600818,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM","updatedAt":1793989631007}