CVE-2026-68296: net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM

CVE-2026-68296: net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM

Before commit 00d066a4d4ed ("netdev_features: convert NETIF_F_LLTX to
dev->lltx"), NETIF_F_LLTX was set unconditionally in both
__gre_tunnel_init() and ip6gre_tnl_init_features() alongside
GRE_FEATURES:

    dev->features |= GRE_FEATURES | NETIF_F_LLTX;

When that commit converted NETIF_F_LLTX to the dev->lltx flag, it
placed 'dev->lltx = true' after the SEQ/CSUM early returns instead
of before them. This causes GRE/GRETAP/ip6gre tunnels with SEQ or
CSUM+encap to lose lockless TX, reintroducing _xmit_lock acquisition
around their ndo_start_xmit. Since GRE xmit re-enters the stack via
ip_tunnel_xmit(), holding _xmit_lock risks ABBA deadlock with the
underlay device.

  CPU0                        CPU1
  ----                        ----
  lock(&qdisc_xmit_lock_key#6);
                              lock(&qdisc_xmit_lock_key#3);
                              lock(&qdisc_xmit_lock_key#6);
  lock(&qdisc_xmit_lock_key#3);

Fix by moving dev->lltx = true before the early returns in both
functions, restoring the original unconditional behavior.

The Linux kernel CVE team has assigned CVE-2026-68296 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.12 with commit 00d066a4d4edbe559ba6c35153da71d4b2b8a383 and fixed in 6.12.101 with commit 9f948e9aede9678f4103457daf2bc9dd54c65a06
	Issue introduced in 6.12 with commit 00d066a4d4edbe559ba6c35153da71d4b2b8a383 and fixed in 6.18.42 with commit 15a1c5f2ed2eeb3daad8d5766fd506aeda4710f3
	Issue introduced in 6.12 with commit 00d066a4d4edbe559ba6c35153da71d4b2b8a383 and fixed in 7.1.6 with commit 2bffe379023512d280337c70faeb6a8cc435db5e
	Issue introduced in 6.12 with commit 00d066a4d4edbe559ba6c35153da71d4b2b8a383 and fixed in 7.2-rc5 with commit 675ed582c1aa4d919dd535490de08c015005c653

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68296
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv4/ip_gre.c
	net/ipv6/ip6_gre.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9f948e9aede9678f4103457daf2bc9dd54c65a06
	https://git.kernel.org/stable/c/15a1c5f2ed2eeb3daad8d5766fd506aeda4710f3
	https://git.kernel.org/stable/c/2bffe379023512d280337c70faeb6a8cc435db5e
	https://git.kernel.org/stable/c/675ed582c1aa4d919dd535490de08c015005c653