CVE-2026-72296 (GCVE-0-2026-72296)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:42
VLAI
Title
net: ife: require ETH_HLEN to be pullable in ife_decode()
Summary
In the Linux kernel, the following vulnerability has been resolved: net: ife: require ETH_HLEN to be pullable in ife_decode() ife decode may return after making only the outer IFE header and metadata pullable. The caller then passes the decapsulated packet to eth_type_trans(), which expects the inner Ethernet header to be accessible from the linear data area. With a malformed IFE frame, the inner Ethernet header may still be shorter than ETH_HLEN in the linear area, which can lead to a crash in the original code. Fix this by extending the pull check in ife_decode() so that the inner Ethernet header is also guaranteed to be pullable before returning.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ef6980b6becb1afd9d82a4f043749a10ae81bf14 , < 70013f9163bef7fbd9fa62f81cf91b2a7ba66163 (git)
Affected: ef6980b6becb1afd9d82a4f043749a10ae81bf14 , < be272e159dfe1207b67332ad6e17adcf59b4ea4b (git)
Affected: ef6980b6becb1afd9d82a4f043749a10ae81bf14 , < 8c8818e52fddb247ff3214622401a4de6ff8482e (git)
Affected: ef6980b6becb1afd9d82a4f043749a10ae81bf14 , < 9433578bff9c100c466a6354574892e55293cb8f (git)
Affected: ef6980b6becb1afd9d82a4f043749a10ae81bf14 , < 1cb42ec10294a55380e52e674b3df2b962648242 (git)
Affected: ef6980b6becb1afd9d82a4f043749a10ae81bf14 , < 5526d1997aea6c9bd865ca4d4894b52e799d735c (git)
Affected: ef6980b6becb1afd9d82a4f043749a10ae81bf14 , < b69ad768cd4a2ef4e07c18492ae85438ed17c7cb (git)
Affected: ef6980b6becb1afd9d82a4f043749a10ae81bf14 , < 9406f6012b7343661efb516a11c62d4db2b62f75 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.6
Unaffected: 0 , < 4.6 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ife/ife.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "70013f9163bef7fbd9fa62f81cf91b2a7ba66163",
              "status": "affected",
              "version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
              "versionType": "git"
            },
            {
              "lessThan": "be272e159dfe1207b67332ad6e17adcf59b4ea4b",
              "status": "affected",
              "version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
              "versionType": "git"
            },
            {
              "lessThan": "8c8818e52fddb247ff3214622401a4de6ff8482e",
              "status": "affected",
              "version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
              "versionType": "git"
            },
            {
              "lessThan": "9433578bff9c100c466a6354574892e55293cb8f",
              "status": "affected",
              "version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
              "versionType": "git"
            },
            {
              "lessThan": "1cb42ec10294a55380e52e674b3df2b962648242",
              "status": "affected",
              "version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
              "versionType": "git"
            },
            {
              "lessThan": "5526d1997aea6c9bd865ca4d4894b52e799d735c",
              "status": "affected",
              "version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
              "versionType": "git"
            },
            {
              "lessThan": "b69ad768cd4a2ef4e07c18492ae85438ed17c7cb",
              "status": "affected",
              "version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
              "versionType": "git"
            },
            {
              "lessThan": "9406f6012b7343661efb516a11c62d4db2b62f75",
              "status": "affected",
              "version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ife/ife.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ife: require ETH_HLEN to be pullable in ife_decode()\n\nife decode may return after making only the outer IFE header and\nmetadata pullable. The caller then passes the decapsulated packet to\neth_type_trans(), which expects the inner Ethernet header to be\naccessible from the linear data area.\n\nWith a malformed IFE frame, the inner Ethernet header may still be\nshorter than ETH_HLEN in the linear area, which can lead to a crash in\nthe original code.\n\nFix this by extending the pull check in ife_decode() so that the inner\nEthernet header is also guaranteed to be pullable before returning."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is hit on the ingress packet receive path (__netif_receive_skb_core\u2192sch_handle_ingress\u2192tc_run\u2192tcf_ife_act\u2192ife_decode) when a remote peer sends a malformed IFE-encapsulated Ethernet frame to a netdev with clsact/ingress IFE decode, as in SDN/NFV/ForCES edge nodes.\nAC:L - Once ingress IFE decode is present, the attacker fully controls the crafted frame (metalen, metadata size, and skb layout) to leave the inner Ethernet header non-linear or shorter than ETH_HLEN, deterministically reaching eth_type_trans() without races or uncontrollable memory layout.\nPR:N - Remote exploitation needs no credentials or capabilities on the victim\u2014only delivery of a malformed frame to an interface already configured with IFE decode; CAP_NET_ADMIN is an operator deployment prerequisite, not attacker privilege (same model as pre-configured nftables offload bugs).\nUI:N - No victim user action is required beyond normal network delivery of attacker-crafted IFE traffic; exploitation does not depend on mounting, opening files, or administrator interaction at attack time.\nS:U - Impact is confined to kernel packet-processing memory within the same kernel security authority; this is not a VM escape, IOMMU bypass, or cross-namespace scope change.\nC:H - eth_type_trans() reads the inner struct ethhdr (h_dest/h_proto) via eth_skb_pull_mac()/eth_skb_pkt_type() without ensuring ETH_HLEN bytes are linear, causing an out-of-bounds kernel read that can disclose adjacent skb/page memory beyond a few bytes.\nI:N - The defect is a missing pskb_may_pull() bounds check leading to out-of-bounds reads and crash; there is no write, UAF, or demonstrated arbitrary modification or control-flow hijack primitive.\nA:H - The fix commit states malformed IFE frames can crash the kernel; accessing a non-linear or undersized inner Ethernet header in eth_type_trans() can trigger KASAN faults, oops, or panic on the softirq receive path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:29.172Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/70013f9163bef7fbd9fa62f81cf91b2a7ba66163"
        },
        {
          "url": "https://git.kernel.org/stable/c/be272e159dfe1207b67332ad6e17adcf59b4ea4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c8818e52fddb247ff3214622401a4de6ff8482e"
        },
        {
          "url": "https://git.kernel.org/stable/c/9433578bff9c100c466a6354574892e55293cb8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/1cb42ec10294a55380e52e674b3df2b962648242"
        },
        {
          "url": "https://git.kernel.org/stable/c/5526d1997aea6c9bd865ca4d4894b52e799d735c"
        },
        {
          "url": "https://git.kernel.org/stable/c/b69ad768cd4a2ef4e07c18492ae85438ed17c7cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/9406f6012b7343661efb516a11c62d4db2b62f75"
        }
      ],
      "title": "net: ife: require ETH_HLEN to be pullable in ife_decode()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72296",
    "datePublished": "2026-08-15T05:55:17.250Z",
    "dateReserved": "2026-08-09T03:40:39.917Z",
    "dateUpdated": "2026-08-17T05:42:29.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72296",
      "date": "2026-09-20",
      "epss": "0.00714",
      "percentile": "0.52209"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/ife/ife.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "70013f9163bef7fbd9fa62f81cf91b2a7ba66163",
                    "status": "affected",
                    "version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "be272e159dfe1207b67332ad6e17adcf59b4ea4b",
                    "status": "affected",
                    "version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8c8818e52fddb247ff3214622401a4de6ff8482e",
                    "status": "affected",
                    "version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9433578bff9c100c466a6354574892e55293cb8f",
                    "status": "affected",
                    "version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1cb42ec10294a55380e52e674b3df2b962648242",
                    "status": "affected",
                    "version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5526d1997aea6c9bd865ca4d4894b52e799d735c",
                    "status": "affected",
                    "version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b69ad768cd4a2ef4e07c18492ae85438ed17c7cb",
                    "status": "affected",
                    "version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9406f6012b7343661efb516a11c62d4db2b62f75",
                    "status": "affected",
                    "version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/ife/ife.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.6"
                  },
                  {
                    "lessThan": "4.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ife: require ETH_HLEN to be pullable in ife_decode()\n\nife decode may return after making only the outer IFE header and\nmetadata pullable. The caller then passes the decapsulated packet to\neth_type_trans(), which expects the inner Ethernet header to be\naccessible from the linear data area.\n\nWith a malformed IFE frame, the inner Ethernet header may still be\nshorter than ETH_HLEN in the linear area, which can lead to a crash in\nthe original code.\n\nFix this by extending the pull check in ife_decode() so that the inner\nEthernet header is also guaranteed to be pullable before returning."
          }
        ],
        "id": "CVE-2026-72296",
        "lastModified": "2026-08-17T06:18:32.417",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:02.160",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1cb42ec10294a55380e52e674b3df2b962648242"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5526d1997aea6c9bd865ca4d4894b52e799d735c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/70013f9163bef7fbd9fa62f81cf91b2a7ba66163"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8c8818e52fddb247ff3214622401a4de6ff8482e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9406f6012b7343661efb516a11c62d4db2b62f75"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9433578bff9c100c466a6354574892e55293cb8f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b69ad768cd4a2ef4e07c18492ae85438ed17c7cb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/be272e159dfe1207b67332ad6e17adcf59b4ea4b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T13:43:57+00:00",
      "cve": "CVE-2026-72296",
      "id": "CVE-2026-72296",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: ife: require ETH_HLEN to be pullable in ife_decode()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72296.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:28:26Z",
      "cve": "CVE-2026-72296",
      "id": "CVE-2026-72296",
      "initial_release_date": "2026-08-22T00:54:10Z",
      "product_status:first_fixed": "23",
      "product_status:known_affected": "423",
      "product_status:known_not_affected": "296",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72296",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72296.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.