Linux kernel drivers/net/geneve.c lacks proper inner header offset validation in geneve_gro_complete() when GRO hint state/option parsing disagrees with geneve_gro_receive(), allowing remote crafted UDP GENEVE traffic to drive out-of-bounds reads/writes, leading to kernel info leak, memory corruption, panic, or potential RCE. Affected: Linux 7.0 to `