CVE-2026-72399

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

Remote attackers can deliver multi-fragment frames to an XDP-enabled ingress path that bpf_redirect_map/devmap forwards to an ENETC PF netdev, reaching enetc_xdp_xmit via the standard XDP_REDIRECT flush path without local access.

AC:LAttack complexity, low

Once XDP redirect to ENETC is deployed, an attacker can reliably craft or segment traffic to produce xdp_frames with nr_frags+1>13; no race or uncontrollable memory layout is required to trigger the out-of-bounds write.

PR:NPrivileges required, none

Exploitation requires no attacker privileges when XDP redirect is pre-deployed on the gateway (normal for edge filtering); unprivileged users with CAP_NET_ADMIN via user namespaces can also attach the needed BPF/XDP programs.

UI:NUser interaction, none

No victim interaction is required beyond sending crafted network traffic; exploitation is fully attacker-driven once the XDP redirect datapath exists.

S:UScope, unchanged

Impact is confined to kernel memory corruption and privilege escalation within the same kernel/host security boundary, not a cross-VM or IOMMU scope change.

C:HConfidentiality impact, high

Stack out-of-bounds writes of enetc_tx_swbd structures past a 13-element array corrupt adjacent stack data and pointers, providing a memory-corruption primitive that can be leveraged for arbitrary kernel memory disclosure.

I:HIntegrity impact, high

The overflow writes attacker-influenced enetc_tx_swbd fields (DMA addresses, lengths, frame pointers) beyond the buffer bounds, enabling heap/stack corruption suitable for arbitrary write and potential code execution.

A:HAvailability impact, high

Corrupting stack-resident transmit metadata and pointers in enetc_xdp_xmit can cause immediate kernel oops/panic or hung transmit paths, constituting total loss of availability.