Executive brief
The Linux kernel's enetc network driver contains a buffer overflow vulnerability in its XDP (eXpress Data Path) packet redirect feature. When processing network packets with multiple fragments, the driver fails to validate that the number of fragments fits within its internal buffer, potentially allowing a local attacker with network access to crash the system or execute code with kernel privileges.
Technical details
The vulnerability is a heap buffer overflow in the enetc_xdp_xmit() function within the Freescale enetc Ethernet driver. The xdp_redirect_arr array is statically sized to ENETC_MAX_SKB_FRAGS elements, but the code did not validate that incoming XDP frames had fragment counts within this limit before processing. An attacker can craft an XDP frame with a fragment count greater than or equal to ENETC_MAX_SKB_FRAGS, causing out-of-bounds memory access to the array. The fix adds a bounds check using xdp_frame_has_frags() and xdp_get_shared_info_from_frame() to verify the fragment count before processing. The vulnerability affects systems with the enetc driver compiled in and XDP redirect functionality enabled.
Affected products
- Linux Linux kernel Linux 5.0 and later (prior to fix, specifically in enetc driver from commit 9d2b68cc108d onward)
Timeline
- 2026-06-26: other: Patch submitted by Wei Fang (NXP)
- 2026-07-24: patched: Fix merged into Linux stable tree
- 2026-08-15: disclosed: CVE-2026-72399 published