What is the CVSS score of CVE-2026-72018?

CVE-2026-72018 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72018?

The Linux kernel dibs loopback subsystem vulnerability (CVE-2026-72018, CVSS 7.8) allows authenticated local users to corrupt kernel memory, creating a pathway to privilege escalation that could…. A patch is available.

How to fix or mitigate CVE-2026-72018?

Within 24 hours, identify and inventory all systems running Linux kernel versions prior to 6.12.97, 6.18.40, 7.1.5, or 7.2-rc3 to establish remediation scope, and notify system owners of patch availability and the privilege escalation risk. Within 7 days, apply vendor-released kernel patches by upgrading to 6.12.97, 6.18.40, 7.1.5, 7.2-rc3, or later versions depending on your kernel branch, scheduling reboots during approved maintenance windows and validating patch application through kernel version verification. Within 30 days, complete remediation across all affected systems, conduct post-patch functional testing on critical services, and document patch deployment dates and affected system counts for compliance and audit purposes.

Linux Kernel CVE-2026-72018

EUVD-2026-59117 HIGH

2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-96mx-hwj9-j649

Buffer Overflow Linux Red Hat Suse

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local access required to reach the dibs loopback interface; low privilege is sufficient; OOB kernel write yields full memory corruption with high confidentiality, integrity, and availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 12:46 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 06:21 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 06:21 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

dibs: loopback: validate offset and size in move_data()

The loopback move_data() performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory region bounds natively, the software loopback has no such protection.

A peer-supplied out-of-bounds offset or oversized write would result in an OOB write past the allocated kernel buffer. Add an explicit bounds check before the memcpy to reject such requests with -EINVAL.

AnalysisAI

Out-of-bounds write in the Linux kernel's dibs loopback subsystem enables a local low-privileged attacker to corrupt kernel memory by supplying a crafted offset or oversized write through the move_data() interface, which calls memcpy() without verifying that offset + size stays within the registered DMB's allocated length. The software loopback omits the memory-region bounds enforcement that real ISM hardware provides natively, leaving peer-supplied parameters unchecked. Patch commits are confirmed across four stable kernel branches (6.12.97, 6.18.40, 7.1.5, 7.2-rc3); the vulnerability is not in CISA KEV and no public exploit code has been identified at time of analysis.

Technical ContextAI

The dibs component implements a software loopback emulator for IBM ISM (Internal Shared Memory), a high-speed inter-partition communication fabric specific to IBM Z/LinuxONE platforms. The move_data() function in this loopback path copies data into a registered Direct Memory Buffer (DMB) using peer-supplied offset and size values. On real ISM hardware, the memory controller enforces region bounds natively; the software loopback path trusts these values and passes them directly to memcpy() without an offset + size vs. DMB length check. This constitutes an out-of-bounds heap write (conceptually CWE-787, though NVD lists the CWE field as N/A - likely a data-entry gap rather than a genuine classification dispute). The vulnerability is introduced at kernel commit f7a22071dbf316c982fb44308874bd7ad9ac2091 and was fixed across stable branches by adding a single explicit bounds check that returns -EINVAL on violation.

RemediationAI

Upgrade to a patched Linux kernel version: 6.12.97 for the 6.12.x stable branch (https://git.kernel.org/stable/c/ee188a6b264b71315a67f1b9470faad308b730d2), 6.18.40 for the 6.18.x branch (https://git.kernel.org/stable/c/78237e3c0720fcc6eb9b87e90fd70f63eeca886f), 7.1.5 for the 7.1.x branch (https://git.kernel.org/stable/c/b2f426a9a22886071966432ede8fceafffe12b8c), or 7.2-rc3 (https://git.kernel.org/stable/c/94fe0ab01b480b52bd8f977edbd845ef375d69fd). For systems where ISM loopback emulation is not operationally required, blacklisting the dibs loopback kernel module via /etc/modprobe.d/ eliminates the attack surface entirely with no functional impact on non-ISM workloads - this is the preferred compensating control pending patching, as it removes the vulnerable code path from the running kernel without affecting other subsystems. NVD advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-72018.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72018 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72018

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code