CVE-2026-72399

A flaw was found in the Linux kernel's enetc network driver. This vulnerability occurs in the eXpress Data Path (XDP) frame processing, where the driver fails to properly check the number of fragments in an XDP frame against the allocated buffer size. A remote attacker could exploit this out-of-bounds memory access by sending specially crafted network packets, potentially leading to a denial of service or arbitrary code execution.

An out of bounds access in the ENETC XDP_REDIRECT transmit path can occur because xdp_redirect_arr is sized as ENETC_MAX_SKB_FRAGS while an xdp_frame may require more BDs when it carries too many fragments. A crafted or unusual multi fragment XDP frame can make enetc_xdp_frame_to_xdp_tx_swbd operate past the stack array boundary, which makes this a kernel memory corruption candidate rather than a pure resource exhaustion issue. For the CVSS the PR:N is used in the paranoid score because a remote or adjacent sender may not need privileges on the target if an XDP_REDIRECT setup is already active. The issue is best treated as adjacent network reachable because exploitation depends on a specific NIC and XDP redirect data path, often in the same L2 or controlled network segment. Impact is at least denial of service via kernel crash and in the worst case may allow confidentiality or integrity impact due to kernel stack memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.