CVE-2026-72399
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In the Linux kernel's enetc driver, the number of BDs needed for xdp_frame is not checked. The xdp_redirect_arr array has size ENETC_MAX_SKB_FRAGS, but the number of fragments in xdp_frame can be greater or equal, leading to an out-of-bounds array access.
Risk Assessment
This could lead to memory corruption, system crash, or potential code execution in kernel context.
Recommendation
Install a Linux kernel patch that adds a check on the number of fragments before accessing xdp_redirect_arr.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: enetc: check the number of BDs needed for xdp_frame The size of xdp_redirect_arr array is ENETC_MAX_SKB_FRAGS. However, the number of fragments contained in xdp_frame may be greater than or equal to ENETC_MAX_SKB_FRAGS, which will cause the access to xdp_redirect_arr to be out of bounds.