CVE-2026-72296

net: ife: require ETH_HLEN to be pullable in ife_decode()

State: Published
Severity: 9.1 Critical
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ife: require ETH_HLEN to be pullable in ife_decode()

ife decode may return after making only the outer IFE header and metadata pullable. The caller then passes the decapsulated packet to eth_type_trans(), which expects the inner Ethernet header to be accessible from the linear data area.

With a malformed IFE frame, the inner Ethernet header may still be shorter than ETH_HLEN in the linear area, which can lead to a crash in the original code.

Fix this by extending the pull check in ife_decode() so that the inner Ethernet header is also guaranteed to be pullable before returning.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ef6980b6becb1afd9d82a4f043749a10ae81bf14 to before 70013f9163bef7fbd9fa62f81cf91b2a7ba66163Affected ef6980b6becb1afd9d82a4f043749a10ae81bf14 to before be272e159dfe1207b67332ad6e17adcf59b4ea4bAffected ef6980b6becb1afd9d82a4f043749a10ae81bf14 to before 8c8818e52fddb247ff3214622401a4de6ff8482eAffected ef6980b6becb1afd9d82a4f043749a10ae81bf14 to before 9433578bff9c100c466a6354574892e55293cb8fAffected ef6980b6becb1afd9d82a4f043749a10ae81bf14 to before 1cb42ec10294a55380e52e674b3df2b962648242Affected ef6980b6becb1afd9d82a4f043749a10ae81bf14 to before 5526d1997aea6c9bd865ca4d4894b52e799d735cAffected ef6980b6becb1afd9d82a4f043749a10ae81bf14 to before b69ad768cd4a2ef4e07c18492ae85438ed17c7cbAffected ef6980b6becb1afd9d82a4f043749a10ae81bf14 to before 9406f6012b7343661efb516a11c62d4db2b62f75Affected
LinuxLinux	4.6Affected before 4.6Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

ef6980b6becb1afd9d82a4f043749a10ae81bf14 to before 70013f9163bef7fbd9fa62f81cf91b2a7ba66163Affected
ef6980b6becb1afd9d82a4f043749a10ae81bf14 to before be272e159dfe1207b67332ad6e17adcf59b4ea4bAffected
ef6980b6becb1afd9d82a4f043749a10ae81bf14 to before 8c8818e52fddb247ff3214622401a4de6ff8482eAffected
ef6980b6becb1afd9d82a4f043749a10ae81bf14 to before 9433578bff9c100c466a6354574892e55293cb8fAffected
ef6980b6becb1afd9d82a4f043749a10ae81bf14 to before 1cb42ec10294a55380e52e674b3df2b962648242Affected
ef6980b6becb1afd9d82a4f043749a10ae81bf14 to before 5526d1997aea6c9bd865ca4d4894b52e799d735cAffected
ef6980b6becb1afd9d82a4f043749a10ae81bf14 to before b69ad768cd4a2ef4e07c18492ae85438ed17c7cbAffected
ef6980b6becb1afd9d82a4f043749a10ae81bf14 to before 9406f6012b7343661efb516a11c62d4db2b62f75Affected

LinuxLinux

4.6Affected
before 4.6Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.