External risk intelligence

Linux Kernel ENETC Out-of-Bounds Access in XDP Frame Handling

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72399

This vulnerability exists within the Linux kernel network driver code (ENETC). It involves low-level buffer handling for XDP frames, which is an internal kernel-space operation. It is not directly reachable as a public-facing service or application endpoint, making exposure to the internet extremely unlikely.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Linux kernel's network handling, specifically within the ENETC driver. This issue could potentially allow for out-of-bounds access, impacting the integrity and availability of network operations. The main concern is confirming relevance and exposure.

Out-of-bounds access in network code.
Affects internal kernel operations.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could leverage this vulnerability by sending specially crafted network traffic to a system running a vulnerable version of the Linux kernel. This traffic would target the enetc network driver, specifically its handling of XDP frames. If the crafted traffic causes the number of fragments in an xdp_frame to exceed a certain limit, it can lead to an out-of-bounds write in the xdp_redirect_arr.

Network-based entry condition.
Triggered by malformed XDP frame data.
Can cause system instability or compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's network driver could allow an attacker to cause a buffer out-of-bounds access. This may lead to unexpected system behavior or potential denial of service when processing network traffic.

Kernel network processing could be affected.
Out-of-bounds write may occur.
System instability or crashes may result.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Linux kernel's `enetc` network driver requires immediate attention from infrastructure and platform teams responsible for Linux systems. The first step is to inventory all systems running the affected kernel version, confirm exposure to network traffic, and identify the accountable owner for each system. Remediation planning should then prioritize critical, exposed assets.

Infrastructure and platform teams own remediation.
Verify systems with network exposure first.
Plan updates based on asset criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ENETC driver in the Linux kernel?

The ENETC driver is a component of the Linux kernel responsible for managing network communications for specific Ethernet controller hardware. It acts as the intermediary that allows the operating system to send and receive data packets through these network interfaces. In this context, the driver is specifically tasked with handling advanced packet processing features, including XDP frames, which are used for high-performance networking tasks.

Why does CVE-2026-72399 cause out-of-bounds access?

This vulnerability is an out-of-bounds write error. It occurs because the driver does not properly verify if the number of data fragments in an XDP frame exceeds the capacity of an internal storage array. When a frame contains too many fragments, the software attempts to write data into memory locations outside the allocated boundaries of that array, which can corrupt nearby data or crash the system.

How is this Linux kernel vulnerability triggered?

The condition is triggered when the kernel receives specially crafted network traffic designed to exceed the fragment limit of the ENETC driver's XDP frame processing. It is important to note that standard, well-formed network traffic does not trigger this error. The bug is specifically tied to the internal logic handling these frames, rather than general network activity.

Do I need to worry about this if my system is internal?

According to Halo Surface Signal, this vulnerability is very unlikely to be reachable from the internet. Because the bug exists deep within low-level kernel-space code related to driver packet handling, it is not directly exposed as a standard network service or application endpoint. Systems isolated from public networks face a significantly lower risk profile regarding this specific flaw.

What is the first step to address this kernel issue?

Start by inventorying your infrastructure to identify which systems are running the affected Linux kernel version with the ENETC driver. Once you have a list of potentially affected assets, verify their network configuration to determine their exposure. Finally, coordinate with your platform teams to prioritize these systems for kernel updates, focusing on those most critical to your environment.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.