CVE-2026-72296

A flaw was found in the Linux kernel's In-band Flow Engine (IFE) component. A remote attacker could send a specially crafted IFE frame with a malformed inner Ethernet header. This improper handling of the packet structure could lead to a system crash, resulting in a Denial of Service (DoS).

A moderate-impact flaw was found in the Linux kernel's In-band Flow Engine (IFE) subsystem. If a malformed IFE frame is processed, ife_decode() may return after making only the outer IFE header and its metadata pullable, leaving the inner Ethernet header shorter than ETH_HLEN in the linear data area. The decapsulated packet is then handed to eth_type_trans(), which expects the inner Ethernet header to be directly accessible, causing an out-of-bounds read that can crash the kernel and result in a denial of service. Exploiting this flaw requires sending specially crafted IFE-encapsulated frames to a host where an IFE traffic-control action is configured, which in practice limits attacks to the network segment where IFE encapsulation is deployed. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel packages tracked for this flaw are not affected because the vulnerable code is not present in them. The Red Hat severity of moderate (CVSS 3.1 score 5.5, local attack vector, availability-only impact) differs significantly from the CVE.org rating of critical (score 9.1, network attack vector with confidentiality impact) because triggering the flaw depends on an IFE action being configured and on access to the encapsulated traffic domain, and the available evidence supports a denial-of-service impact rather than a confidentiality impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.