What is the CVSS score of CVE-2026-72003?

CVE-2026-72003 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72003?

A critical heap overflow in Linux WiFi driver brcmfmac/cyw permits kernel-level code execution through rogue wireless access point attacks during WPA3 authentication, creating exposure for Linux…. A patch is available.

How to fix or mitigate CVE-2026-72003?

Immediate action (within 24 hours): inventory Linux systems running brcmfmac/cyw WiFi driver to identify which machines require patching, and implement interim mitigations such as disabling WPA3 in favor of WPA2 authentication or restricting WiFi access on non-critical systems. Short-term (within 7 days): obtain and stage vendor patches per available advisory, then deploy to production Linux endpoints in priority order (servers first, then endpoints). Long-term (within 30 days): complete patch rollout across all affected Linux infrastructure, verify kernel versions have been updated, and audit WiFi driver enablement to disable unnecessary wireless drivers on systems requiring only wired connectivity.

Linux Kernel CVE-2026-72003

EUVD-2026-59102 HIGH

2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-chrv-c8hf-p9c7

Buffer Overflow Linux Microsoft Red Hat Suse

8.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Adjacent-only vector confirmed by AP-triggered path; no auth or interaction needed from victim; full kernel impact justifies C/I/A:H.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

7.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Red Hat

7.0 HIGH

qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 12:50 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 06:20 cve.org

HIGH 8.8

CVE Published

Aug 15, 2026 - 06:20 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: cyw: fix heap overflow on a short auth frame

brcmf_notify_auth_frame_rx() takes the frame length from the firmware event and copies the frame body with the management header offset subtracted:

u32 mgmt_frame_len = e->datalen - sizeof(struct brcmf_rx_mgmt_data); ... memcpy(&mgmt_frame->u, frame, mgmt_frame_len - offsetof(struct ieee80211_mgmt, u));

The only length check is e->datalen >= sizeof(*rxframe), so mgmt_frame_len can be anything from 0 up. offsetof(struct ieee80211_mgmt, u) is 24. When mgmt_frame_len is below that, the subtraction wraps as an unsigned value to a huge length. The memcpy then runs far past the kzalloc'd buffer. A malicious or malfunctioning AP can make the frame short during the external SAE auth exchange, so this is a remotely triggered heap overflow.

Reject frames shorter than the management header offset before the copy.

AnalysisAI

Heap overflow in the Linux kernel brcmfmac/cyw WiFi driver allows a network-adjacent attacker controlling a rogue or compromised access point to corrupt kernel heap memory during WPA3 SAE authentication. The flaw in brcmf_notify_auth_frame_rx() causes an unsigned integer underflow when a short auth frame (under 24 bytes) is received, producing a wrap-around copy length that drives memcpy far beyond the allocated buffer. With CVSS 8.8 and full C/H/I/H/A/H impact on the vulnerable system, exploitation yields arbitrary kernel memory write capability; no public exploit has been identified at time of analysis and EPSS sits at 0.21% (12th percentile), indicating low observed exploitation pressure despite the critical technical severity.

Technical ContextAI

The brcmfmac driver (drivers/net/wireless/broadcom/brcm80211/brcmfmac) handles Broadcom/Cypress (CYW-series) FullMAC WiFi chipsets, commonly found in Raspberry Pi boards, Chromebooks, IoT devices, and some Microsoft Surface-adjacent hardware (reflected in the 'Microsoft' tag). The vulnerability originates in brcmf_notify_auth_frame_rx(), which processes management frames forwarded by firmware during an external SAE (Simultaneous Authentication of Equals / WPA3) exchange. The root cause is a missing lower-bound check before the subtraction mgmt_frame_len - offsetof(struct ieee80211_mgmt, u): since mgmt_frame_len is a u32 and offsetof(struct ieee80211_mgmt, u) is 24, any frame body shorter than 24 bytes causes unsigned wraparound to a value near UINT32_MAX. The subsequent memcpy into the kzalloc'd mgmt_frame buffer then writes far beyond it. The CWE is not formally assigned, but this is a classic heap-based buffer overflow (CWE-122) stemming from a missing input validation / integer underflow (CWE-191) at a firmware-controlled data path boundary. Affected kernel range starts at commit 66f909308a7c05082919ff214a0bbe2a76aa0283.

RemediationAI

The primary remediation is to update the Linux kernel to a patched stable release: 6.18.40, 7.1.5, or 7.2-rc4 as applicable to the deployed kernel series. Upstream fix commits are available at https://git.kernel.org/stable/c/185bb156c427d0f865d344a6d0eaa02c6d05cc57, https://git.kernel.org/stable/c/240c8d2c717b3f8153e7e877b22a82518d78dbdc, and https://git.kernel.org/stable/c/55b26abb1fa1ec406b3ad11b43c49c7624257565. Distribution maintainers (Debian, Ubuntu, RHEL, Arch, etc.) should be checked for backported stable patches if the kernel cannot be updated immediately. As a compensating control where patching is not immediately possible, disabling the brcmfmac kernel module (modprobe -r brcmfmac) eliminates the attack surface entirely but removes WiFi functionality for affected chipsets. Alternatively, restricting the device to WPA2-only networks prevents the SAE (WPA3) authentication path from being triggered, since the vulnerable code is exercised during external SAE exchanges; however this trade-off degrades network security posture. Isolating affected devices to trusted-AP environments reduces adjacency-based exposure but does not eliminate it if AP infrastructure is compromised.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72003 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72003

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code