A vulnerability marked as critical has been reported in Linux Kernel up to 6.6.129/6.12.77/6.18.16/6.19.6/7.0-rc1. This impacts the function gve_tx_clean_pending_packets of the file drivers/net/ethernet/drivers/net/ethernet/google/gve/gve_tx_dqo.c of the component gve. The manipulation leads to improper validation of array index. This vulnerability is documented as CVE-2026-23386. The attack requires being on the local network. It is suggested to upgrade the affected component.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | a6fb8d5a8b6925f1e635818d3dd2d89531d4a058, a6fb8d5a8b6925f1e635818d3dd2d89531d4a058, a6fb8d5a8b6925f1e635818d3dd2d89531d4a058, a6fb8d5a8b6925f1e635818d3dd2d89531d4a058, a6fb8d5a8b6925f1e635818d3dd2d89531d4a058, 6.6, 6.6.129, 6.12.77, 6.18.16, 6.19.6, 7.0-rc1 |
Updated description with critical vulnerability details, added new affected versions, and changed severity to CRITICAL.
Initial creation
