CVE-2026-68296

In the Linux kernel, the following vulnerability has been resolved:

net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM

Before commit 00d066a4d4ed ("netdev_features: convert NETIF_F_LLTX to

dev->lltx"), NETIF_F_LLTX was set unconditionally in both

__gre_tunnel_init() and ip6gre_tnl_init_features() alongside

GRE_FEATURES:

dev->features |= GRE_FEATURES | NETIF_F_LLTX;

When that commit converted NETIF_F_LLTX to the dev->lltx flag, it

placed 'dev->lltx = true' after the SEQ/CSUM early returns instead

of before them. This causes GRE/GRETAP/ip6gre tunnels with SEQ or

CSUM+encap to lose lockless TX, reintroducing _xmit_lock acquisition

around their ndo_start_xmit. Since GRE xmit re-enters the stack via

ip_tunnel_xmit(), holding _xmit_lock risks ABBA deadlock with the

underlay device.

CPU0 CPU1

---- ----

lock(&qdisc_xmit_lock_key#6);

lock(&qdisc_xmit_lock_key#3);

lock(&qdisc_xmit_lock_key#6);

lock(&qdisc_xmit_lock_key#3);

Fix by moving dev->lltx = true before the early returns in both

functions, restoring the original unconditional behavior.