CVE-2026-72296net: ife: require ETH_HLEN to be pullable in ife_decode()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: ife: require ETH_HLEN to be pullable in ife_decode() ife decode may return after making only the outer IFE header and metadata pullable. The caller then passes the decapsulated packet to eth_type_trans(), which expects the inner Ethernet header to be accessible from the linear data area. With a malformed IFE frame, the inner Ethernet header may still be shorter than ETH_HLEN in the linear area, which can lead to a crash in the original code. Fix this by extending the pull check in ife_decode() so that the inner Ethernet header is also guaranteed to be pullable before returning.
- CVSS
- 9.1 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ef6980b6becb1afd9d82a4f043749a10ae81bf14 before 70013f9163bef7fbd9fa62f81cf91b2a7ba66163; from ef6980b6becb1afd9d82a4f043749a10ae81bf14 before be272e159dfe1207b67332ad6e17adcf59b4ea4b; from ef6980b6becb1afd9d82a4f043749a10ae81bf14 before 8c8818e52fddb247ff3214622401a4de6ff8482e; from ef6980b6becb1afd9d82a4f043749a10ae81bf14 before 9433578bff9c100c466a6354574892e55293cb8f; from ef6980b6becb1afd9d82a4f043749a10ae81bf14 before 1cb42ec10294a55380e52e674b3df2b962648242; from ef6980b6becb1afd9d82a4f043749a10ae81bf14 before 5526d1997aea6c9bd865ca4d4894b52e799d735c; from ef6980b6becb1afd9d82a4f043749a10ae81bf14 before b69ad768cd4a2ef4e07c18492ae85438ed17c7cb; from ef6980b6becb1afd9d82a4f043749a10ae81bf14 before 9406f6012b7343661efb516a11c62d4db2b62f75 | CNA record |
References
- https://git.kernel.org/stable/c/70013f9163bef7fbd9fa62f81cf91b2a7ba66163
- https://git.kernel.org/stable/c/be272e159dfe1207b67332ad6e17adcf59b4ea4b
- https://git.kernel.org/stable/c/8c8818e52fddb247ff3214622401a4de6ff8482e
- https://git.kernel.org/stable/c/9433578bff9c100c466a6354574892e55293cb8f
- https://git.kernel.org/stable/c/1cb42ec10294a55380e52e674b3df2b962648242
- https://git.kernel.org/stable/c/5526d1997aea6c9bd865ca4d4894b52e799d735c
- https://git.kernel.org/stable/c/b69ad768cd4a2ef4e07c18492ae85438ed17c7cb
- https://git.kernel.org/stable/c/9406f6012b7343661efb516a11c62d4db2b62f75
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.