high 7.5

CVE-2026-68129 json

gve: fix Rx queue stall on alloc failure

published 2026-08-10 2 mo ago modified 2026-10-19 20 d ago also EUVD-2026-55510

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

When the system is under extreme memory pressure, page allocations can fail during the Rx buffer refill loop. If the number of buffers posted to hardware falls below a critical low threshold and the refill loop exits due to allocation failures, the queue can stall:

1. The device drops incoming packets because there are no descriptors. 2. Since no packets are processed, no Rx completions are generated. 3. Because no completions occur, NAPI is never scheduled, preventing the refill loop from running again even after memory is freed.

This results in a permanent queue stall.

Resolve this by introducing a starvation recovery timer for each Rx queue. If the number of buffers posted to hardware falls below a critical low threshold, start a timer to periodically reschedule NAPI. Once NAPI runs and successfully refills the queue above the threshold, the timer is not rescheduled.

The threshold is set to 32 because a single maximum-sized Receive Segment Coalescing (RSC) packet can consume up to 19 descriptors in the Rx path. Lower thresholds (such as 8 or 16) would be insufficient to process a complete maximum-sized RSC packet, risking packet drops or unexpected hardware behavior under memory pressure. Setting the threshold to 32 guarantees a safe margin to handle at least one full RSC packet.

Patch / fix

fixed in 1 distros 5 links 7

Linux Linux 5.15.216, 6.1.183, 6.6.151, 6.12.101, 6.18.42, 7.1.6, 7.2

debian ubuntu suse opensuse azure linux

linux Debian 12 6.1.187-1
linux Debian 13 6.12.101-1
linux Debian 14 7.1.6-1
linux-6.12 Debian 12 6.12.101-1~deb12u1

debian advisories DEBIAN-CVE-2026-68129

linux Ubuntu 22.04 LTS 5.15.0-198.208
linux Ubuntu 24.04 LTS 6.8.0-147.147
linux Ubuntu 26.04 LTS 7.0.0-38.38
linux-aws Ubuntu 22.04 LTS 5.15.0-1117.124
linux-aws Ubuntu 24.04 LTS 6.8.0-1067.70
linux-aws Ubuntu 26.04 LTS 7.0.0-1014.14
linux-gcp Ubuntu 22.04 LTS 5.15.0-1118.128
linux-gcp Ubuntu 24.04 LTS 6.8.0-1071.79

ubuntu advisories UBUNTU-CVE-2026-68129

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.81.1
kernel-syms SLE Module for Development Tools 15 SP7 6.4.0-150700.53.81.1
kernel-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.53.81.1
kernel-source SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 6.4.0-150700.53.81.1
kernel-default SLE Workstation Extension 15 SP7, SLE Module for Legacy 15 SP7, SLE Module for Basesystem 15 SP7 +2 more 6.4.0-150700.53.81.1
kernel-zfcpdump SLE Module for Basesystem 15 SP7 6.4.0-150700.53.81.1
kernel-obs-build SLE Module for Development Tools 15 SP7 6.4.0-150700.53.81.1
kernel-default-base SLE Module for Basesystem 15 SP7 6.4.0-150700.53.81.1.150700.17.45.1

suse advisories SUSE-SU-2026:4254-1 SUSE-SU-2026:23887-1 SUSE-SU-2026:23902-1 SUSE-SU-2026:23897-1 SUSE-SU-2026:23881-1 SUSE-SU-2026:4282-1

kernel-rt openSUSE Leap 16.0 6.12.0-160000.38.1
dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.38.1
kernel-64kb openSUSE Leap 16.0 6.12.0-160000.38.1
kernel-syms openSUSE Leap 16.0 6.12.0-160000.38.1
kernel-azure openSUSE Leap 16.0 6.12.0-160000.38.1
kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.38.1
kernel-source openSUSE Leap 16.0 6.12.0-160000.38.1
kernel-default openSUSE Leap 16.0 6.12.0-160000.38.1

opensuse advisories openSUSE-SU-2026:21910-1

kernel Azure Linux 3.0 6.6.152.1-1

azure linux advisories AZL-95010

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-68129 updated 2026-11-05 cvss 5.5

kernel: gve: fix Rx queue stall on alloc failure

Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +30 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +84 more Red Hat Enterprise Linux 10 kernel 6.12.0-211.46.1.el10_2
affected: workaround, no fix available “To mitigate this issue, prevent the gve module from loading. See https://access.redhat.com/solutions/41278 for instructions.”
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +2 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +9 more Red Hat Enterprise Linux for NVIDIA 26 kernel 6.12.0-211.46.1.el10_2 Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 23 d ago (2026-10-16)

Exploit prediction

0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Linux Linux

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2026-68129
NVD CVE-2026-68129

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary