## Summary
CVE-2026-72046 is a Linux kernel DQO RX datapath bug in the gve driver that can corrupt per-packet split headers when header-split and HW-GRO are enabled. The root issue is incorrect indexing of the header buffer: the driver uses queue position on post/read instead of the buffer identity (buf_id), which breaks under out-of-order completions.
## Technical Details
The driver programs header_buf_addr during gve_rx_post_buffers_dqo and later reads the split header during gve_rx_dqo.
- On post, header_buf_addr is computed from bufq->tail.
- On completion read, the header is read from desc_idx (completion queue head index).
This assumes buffer-queue and completion-queue indices stay aligned for each packet. With HW-GRO enabled across multiple flows, coalesced segments may complete in an order different from posting, and segments from different flows may interleave.
Two resulting failures are described:
- Wrong header slot on read: the device writes the header to the address programmed for the buffer’s buf_id, but the driver reads using the completion index (desc_idx), so it may copy a header for a different packet. Observed impact includes ~30% throughput drop and many TCP retransmissions when header-split + HW-GRO are both enabled with many streams.
- Header buffer reused while still owned by the device: the driver advances bufq->head per completion and re-posts based on that. Receiving N completions only guarantees N descriptors were read, not that the device relinquished ownership of all corresponding buffers. With out-of-order completions, the driver can re-post and overwrite a header buffer still being written by the device.
The upstream fix indexes the header buffer by buf_id on both post and read paths, and allocates/frees header buffers based on num_buf_states (gve_rx_alloc_hdr_bufs, gve_rx_free_hdr_bufs).
## Affected
- Linux kernel gve DQO RX datapath logic involving gve_rx_post_buffers_dqo and gve_rx_dqo.
- Configurations where header-split and HW-GRO are enabled, especially with multiple flows.
## Impact
- Header corruption leading to throughput degradation (about 30% drop) and large numbers of TCP retransmissions.
- Potential memory corruption within RX header buffers due to reuse/overwrite while still owned by the device.
## Mitigation
1. Apply the upstream fix commit d676c9a73bdcd8237425dbb826f2bd1a25c36e40 (referenced as upstream for stable trees).
2. Ensure the driver indexes header buffers by buf_id on both gve_rx_post_buffers_dqo and gve_rx_dqo, and that header buffer allocation/freeing matches num_buf_states (gve_rx_alloc_hdr_bufs / gve_rx_free_hdr_bufs).
3. As a temporary operational workaround (if patching is not immediately possible), avoid the vulnerable combination of header-split with HW-GRO under multi-flow workloads.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H