vmxnet3 Geneve Panic

Vulnerability analysis

The vmxnet3 driver's header-length parsing function assumes that completion descriptor fields always describe the outer packet header, but for Geneve-encapsulated packets the virtual device may populate them based on the inner header instead, indicated by a bit in the completion descriptor. When this happens, the function misinterprets the packet structure and triggers kernel assertions that immediately panic the system — for example, because the outer protocol is UDP (Geneve) rather than TCP, or because the outer and inner IP versions differ. The fix checks the inner-header indicator bit up front and returns early when set, since the function cannot locate the inner header it would need to parse; it also converts all remaining assertions to graceful error returns so that unexpected packet formats never crash the kernel. The vulnerability is reachable by any attacker who can deliver Geneve-encapsulated network packets to a system equipped with a vmxnet3 adapter, which is specific to VMware virtualized environments, and requires no privileges on the target.