Bug 2516644 (CVE-2026-72399)

Summary:	CVE-2026-72399 kernel: net: enetc: check the number of BDs needed for xdp_frame
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's enetc network driver. This vulnerability occurs in the eXpress Data Path (XDP) frame processing, where the driver fails to properly check the number of fragments in an XDP frame against the allocated buffer size. A remote attacker could exploit this out-of-bounds memory access by sending specially crafted network packets, potentially leading to a denial of service or arbitrary code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 06:23:39 UTC

In the Linux kernel, the following vulnerability has been resolved:

net: enetc: check the number of BDs needed for xdp_frame

The size of xdp_redirect_arr array is ENETC_MAX_SKB_FRAGS. However, the
number of fragments contained in xdp_frame may be greater than or equal
to ENETC_MAX_SKB_FRAGS, which will cause the access to xdp_redirect_arr
to be out of bounds.

Comment 1 Keith Grant 2026-08-19 15:23:19 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081521-CVE-2026-72399-dfd2@gregkh/T