CVE-2026-72399 net: enetc: check the number of BDs needed for xdp_frame
An out-of-bounds write in the enetc network driver allows attackers to cause memory corruption, potentially leading to system crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72399?
CVE-2026-72399 is a critical memory corruption vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: enetc: check the number of BDs needed for xdp_frame
The size of xdp_redirect_arr array is ENETC_MAX_SKB_FRAGS. However, the number of fragments contained in xdp_frame may be greater than or equal to ENETC_MAX_SKB_FRAGS, which will cause the access to xdp_redirect_arr to be out of bounds.
Which versions are affected by CVE-2026-72399?
How do I fix CVE-2026-72399?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-72399 being exploited?
There is no known exploitation of CVE-2026-72399 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72399, DEBIAN-CVE-2026-72399, GHSA-5679-m6c7-f7x8, UBUNTU-CVE-2026-72399.