Skip to main content

Linux Kernel CVE-2026-72399

| EUVDEUVD-2026-59298 CRITICAL
2026-08-15 Linux GHSA-5679-m6c7-f7x8
Information Disclosure Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.5 MEDIUM

Network-triggered but requires non-default XDP-redirect config plus multi-buffer frames (AC:H); primary impact is kernel DoS (A:H) with possible limited memory disclosure (C:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:04 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.8 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:56 cve.org
CRITICAL 9.8
CVE Published
Aug 15, 2026 - 05:56 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: enetc: check the number of BDs needed for xdp_frame

The size of xdp_redirect_arr array is ENETC_MAX_SKB_FRAGS. However, the number of fragments contained in xdp_frame may be greater than or equal to ENETC_MAX_SKB_FRAGS, which will cause the access to xdp_redirect_arr to be out of bounds.

AnalysisAI

Out-of-bounds array access in the Linux kernel's NXP ENETC Ethernet driver (net/ethernet/freescale/enetc) occurs on the XDP_REDIRECT transmit path when an xdp_frame carries a number of fragments greater than or equal to ENETC_MAX_SKB_FRAGS, overrunning the fixed-size xdp_redirect_arr buffer-descriptor array. Affected are systems using NXP/Freescale ENETC MACs (e.g., LS1028A-class SoCs) with an XDP program that performs redirect on multi-buffer frames, introduced in 5.13 and fixed across current stable branches. No public exploit identified at time of analysis, and EPSS is low (0.21%, 12th percentile), consistent with a driver-specific memory-safety bug rather than a broadly exploited flaw.

Technical ContextAI

ENETC is the integrated Gigabit Ethernet controller found on NXP Layerscape SoCs; its Linux driver supports XDP (eXpress Data Path) including the XDP_REDIRECT action and multi-buffer (scatter) frames. The driver stages buffer descriptors for a redirected frame in a stack array xdp_redirect_arr sized to ENETC_MAX_SKB_FRAGS. Because a multi-buffer xdp_frame can contain a fragment count equal to or exceeding that limit, the transmit-cleanup logic indexes past the end of the array - a classic fixed-size-buffer overrun (CWE-787 out-of-bounds write / CWE-125 out-of-bounds read; NVD lists CWE as N/A). The fix adds an explicit check of the number of BDs required for the xdp_frame before populating the array.

RemediationAI

Vendor-released patch: update to a fixed Linux stable release - 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1.5 (or later on your branch); the fix commits are published at git.kernel.org/stable/c/ (e.g., 1ecb199b0e6d12ab6c26c0b7edf1a8f4472d9aed, f55276160ffad3e235b657ee4b7304eb99b90e5c, cfbc6e9b84dcc0aa2d65c84ea4745af327763209, 1681cc7974a6123f5d5740b03bc11e4784bd2542, d22829101ab675607ad6c3d420fb3ab875f46bbb, 555c5475e787802eeae0d2b91c2f66c330db2767). Apply the distribution kernel update that references CVE-2026-72399. If patching is not immediately possible on affected NXP hardware, the practical compensating control is to avoid attaching XDP programs that use XDP_REDIRECT on ENETC interfaces and/or to reduce the interface MTU to prevent multi-buffer/scatter frames from reaching the redirect path - the trade-off is loss of XDP-accelerated forwarding and reduced maximum frame size, which may impact throughput-sensitive workloads. Restrict who can load XDP/eBPF programs (CAP_NET_ADMIN/CAP_BPF) as defense in depth.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72399 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy