CVE-2026-72296

Received Received - Intake

Linux Kernel IFE Decode Memory Corruption

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: ife: require ETH_HLEN to be pullable in ife_decode() ife decode may return after making only the outer IFE header and metadata pullable. The caller then passes the decapsulated packet to eth_type_trans(), which expects the inner Ethernet header to be accessible from the linear data area. With a malformed IFE frame, the inner Ethernet header may still be shorter than ETH_HLEN in the linear area, which can lead to a crash in the original code. Fix this by extending the pull check in ife_decode() so that the inner Ethernet header is also guaranteed to be pullable before returning.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72296

EUVD

EUVD-2026-59195

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where the ife_decode function may return without ensuring the inner Ethernet header is fully accessible. This can cause eth_type_trans to crash if the inner header is shorter than ETH_HLEN in the linear data area.

Detection Guidance

This vulnerability involves malformed IFE frames causing kernel crashes. Detection requires monitoring for kernel panics or crashes related to network processing. Check system logs for kernel oops messages or crashes with commands like 'dmesg | grep -i panic' or 'journalctl -k | grep -i oops'. Network traffic inspection tools like tcpdump or Wireshark may help identify malformed IFE frames, but specific detection commands are not provided in the context.

Impact Analysis

An attacker could send a malformed IFE frame to crash the system by exploiting this flaw in the Linux kernel's packet handling, leading to denial of service.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to network packet handling that could lead to system crashes under specific conditions. Compliance impacts would only occur if the crash disrupts data processing or availability in systems subject to these regulations.

Mitigation Strategies

Apply the Linux kernel patch that fixes this issue by extending the pull check in ife_decode(). Update your kernel to a version containing the fix. If immediate patching is not possible, consider disabling the IFE module temporarily using 'modprobe -r ife' or restricting network interfaces processing IFE frames until the patch is applied.

Hi! I’m here to help you understand CVE-2026-72296. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70