What is the CVSS score of CVE-2026-72296?

CVE-2026-72296 has a contested CVSS base score of 9.1 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-72296?

The Linux kernel contains a critical denial-of-service vulnerability (CVE-2026-72296, CVSS 9.1) affecting systems with the tc act_ife traffic-control action configured.. A patch is available.

How to fix or mitigate CVE-2026-72296?

Within 24 hours, identify all Linux systems with tc act_ife traffic-control rules active using your configuration management and system inventory tools. Within 7 days, apply the available kernel patch from your Linux distribution vendor-consult your vendor's security advisory to determine the specific patched kernel version for your distribution and release; the patch enhances frame-length validation in the IFE decode function. Within 30 days, verify that all affected systems are running patched kernels and consider disabling tc act_ife entirely on systems that do not require this traffic-control feature.

Linux Kernel CVE-2026-72296

EUVD-2026-59195 CRITICAL

2026-08-15 Linux

GHSA-q79p-vh4m-jfvr

Denial Of Service Linux Red Hat Suse

Critical

Disputed · 9.1 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

7.5 HIGH

Described impact is a kernel crash only, so C:N/I:N/A:H; unauthenticated crafted frame gives PR:N/UI:N, but exploitation depends on the non-default act_ife action being configured.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 08:14 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.1 (CRITICAL)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:55 cve.org

CRITICAL 9.1

CVE Published

Aug 15, 2026 - 05:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: ife: require ETH_HLEN to be pullable in ife_decode()

ife decode may return after making only the outer IFE header and metadata pullable. The caller then passes the decapsulated packet to eth_type_trans(), which expects the inner Ethernet header to be accessible from the linear data area.

With a malformed IFE frame, the inner Ethernet header may still be shorter than ETH_HLEN in the linear area, which can lead to a crash in the original code.

Fix this by extending the pull check in ife_decode() so that the inner Ethernet header is also guaranteed to be pullable before returning.

AnalysisAI

Denial-of-service in the Linux kernel's IFE (Inter-Forwarding-Element) traffic-control action allows a crafted, malformed IFE frame to crash the host, because ife_decode() only guaranteed the outer IFE header was pullable before handing the decapsulated packet to eth_type_trans(), which then reads an inner Ethernet header that may be shorter than ETH_HLEN in the linear skb area. Only systems that have the tc act_ife action configured are exposed. There is no public exploit identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not in CISA KEV; the fix adds ETH_HLEN to the pull check.

Technical ContextAI

IFE is the kernel's Inter-Forwarding-Element encapsulation implemented as a tc (traffic control) action (net/sched/act_ife) that carries metadata between forwarding elements by wrapping an inner Ethernet frame. On the receive path ife_decode() makes the outer IFE header and its metadata TLVs pullable into the skb linear data area, then the caller decapsulates and calls eth_type_trans() to classify the inner frame. eth_type_trans() assumes ETH_HLEN (14) bytes of inner Ethernet header are present linearly. Because ife_decode() did not extend its pull to cover the inner header, a short/truncated inner frame leaves fewer than 14 linear bytes, producing an out-of-bounds/short read on the header - an unchecked buffer access akin to CWE-125 (out-of-bounds read) / improper length validation (CWE-130). CPE data identifies the affected component generically as cpe:2.3:a:linux:linux, i.e. the mainline kernel, with the fault localized to the act_ife code path rather than the whole networking stack.

RemediationAI

Apply the vendor-released kernel update for your branch: upgrade to at least 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40 or 7.1.5 (mainline 7.2-rc1), matching or exceeding the stable version for your series, then reboot into the patched kernel. The fix is the ETH_HLEN pull check in ife_decode(), available as stable commits at https://git.kernel.org/stable/c/9406f6012b7343661efb516a11c62d4db2b62f75 and the parallel backports. If immediate patching is not possible, the highest-value compensating control is to remove the exposure rather than the code: audit tc configurations for the act_ife action (tc filter/action ife) and remove or avoid deploying IFE encapsulation, since a host without act_ife configured cannot reach the vulnerable decode path - the trade-off is loss of IFE metadata forwarding for any topology that legitimately relies on it. Where act_ife must remain, restrict which interfaces and peers can deliver IFE-encapsulated frames to the host (L2 segmentation / trusted forwarding fabric only) to reduce who can send malformed frames.

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-72296 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72296

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code