Skip to main content

Linux Kernel CVE-2026-72041

| EUVDEUVD-2026-58999 CRITICAL
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-55rh-f38r-fhcc
Information Disclosure Linux
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
3.6 LOW

Requires non-default espintcp config and local ability to force partial sends (AV:L/AC:H/PR:L); skmsg mis-accounting yields limited info leak and possible instability (C:L/A:L).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 06:26 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.8 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
CRITICAL 9.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

espintcp: use sk_msg_free_partial to fix partial send

sk_msg_free_partial() ensures consistency of the skmsg at every iteration, without having to manually handle uncharges and offsets. This simplifies the code, and fixes some bugs in skmsg accounting when we don't send the full contents.

AnalysisAI

Memory-accounting corruption in the Linux kernel's espintcp (ESP-in-TCP / IPsec RFC 8229) send path was resolved by switching to sk_msg_free_partial(), which keeps the socket message (skmsg) consistent on partial sends. On affected kernels the previous code mishandled uncharges and offsets when the full payload was not transmitted, corrupting skmsg accounting on a system where TCP encapsulation of IPsec is in use. This is a stable-tree fix carrying an NVD CVSS of 9.8 and the 'Information Disclosure' tag, but EPSS is only 0.20% (10th percentile) and no public exploit is identified at time of analysis.

Technical ContextAI

The flaw lives in espintcp, the kernel's implementation of ESP-over-TCP encapsulation (RFC 8229) used to tunnel IPsec through TCP for NAT/firewall traversal. Outbound data is staged in an sk_msg / skmsg structure - the socket-message scatterlist framework the kernel uses to queue and account for socket-buffer memory. When a send did not flush the full contents, the original code manually adjusted memory charges and ring offsets, and got the bookkeeping wrong. The fix replaces that hand-rolled logic with sk_msg_free_partial(), which atomically releases only the sent portion and re-charges the remainder, guaranteeing skmsg consistency each iteration. NVD lists CWE as N/A; the root cause is best described as incorrect resource/length accounting on a partial operation, which can leave stale or mischarged socket-memory state.

RemediationAI

Vendor-released patch: upgrade to Linux 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1 (or later) as appropriate for your branch, or apply your distribution's kernel update carrying stable commits 007800408002d871f5699bdb944f985896730b8f / 14c0b42c8a2cd9b5361bbff45b52f69c62c6a286 / 54d73f18f8919735f4d04d6f43374f75756c0180 / a338ce41bc933d8f74c39d9b3b6f1d8ca53d9714 / a66d45e0ce6d73cd79962d422388e61bfaf0cb50 (see git.kernel.org/stable/c/<hash>). Where an immediate kernel update is not possible, the practical compensating control is to avoid ESP-in-TCP encapsulation: if your IPsec deployment does not require TCP encapsulation (RFC 8229), disable it in the XFRM/strongSwan/libreswan configuration and rely on standard UDP/ESP or UDP encapsulation instead, which removes the vulnerable espintcp code path - the trade-off is loss of TCP-based NAT/firewall traversal for clients that need it. Restrict which local users and workloads can create IPsec/espintcp sockets. Confirm exact fixed versions against your distribution advisory before scheduling, and reference the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-72041.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72041 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy