What is the CVSS score of CVE-2026-72239?

CVE-2026-72239 has a contested CVSS base score of 9.3 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-72239?

AMD SEV-SNP memory-integrity enforcement is weakened in Linux 7.1 hosts due to a cache synchronization race condition, potentially allowing attackers to breach the security of confidential virtual…. A patch is available.

How to fix or mitigate CVE-2026-72239?

Within 24 hours, inventory all Linux 7.1 systems configured with AMD SEV-SNP to determine exposure scope. Within 7 days, obtain the vendor patch and validate it in a non-production environment to verify no functionality regression. Within 30 days, schedule and execute the patch deployment to all affected production systems using a rolling update strategy to maintain service continuity.

Linux Kernel CVE-2026-72239

EUVD-2026-59138 CRITICAL

2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-mh7r-v762-68jw

Information Disclosure Linux Red Hat Suse

Critical

Disputed · 9.3 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Sources disagree (Medium–Critical)

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Local SNP host access needed (AV:L, PR:L), success hinges on a narrow init-time cache race (AC:H); broken RMP integrity crosses into guest VMs (S:C, C:H/I:H), with no direct availability loss (A:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 07:52 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.3 (CRITICAL)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 06:21 cve.org

CRITICAL 9.3

CVE Published

Aug 15, 2026 - 06:21 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

x86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN"

Revert

99cf1fb58e68 ("x86/virt/sev: Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN").

Section 8.8 of the SNP spec says:

Before invoking SNP_INIT_EX with INIT_RMP set to 1, software must ensure that no CPUs contain dirty cache lines for the memory containing the RMP.

Cachelines can be moved from cache to cache in a dirty state. The wbinvd_on_all_cpus() before SNP_INIT_EX flushes the caches for each CPU, but if the IPIs for WBINVD race with this dirty cacheline movement, it is possible that they may not get flushed, violating the firmware requirement.

Doing wbinvd_on_all_cpus() before setting SNPEn is safer since the RMP table is not yet in use.

[ Heroically bisected by Srikanth. ] [ bp: Massage commit message. ]

AnalysisAI

Weakened AMD SEV-SNP memory-integrity enforcement in the Linux kernel results from a race between WBINVD IPIs and dirty-cacheline migration that can leave Reverse Map Table (RMP) memory with un-flushed dirty cache lines when SNP_INIT_EX is invoked with INIT_RMP=1, violating SNP firmware requirement (spec section 8.8). Affected are Linux 7.1 hosts that had adopted commit 99cf1fb58e68 (which dropped the pre-SNPEn WBINVD); the fix reverts that change so wbinvd_on_all_cpus() again runs before setting MSR_AMD64_SYSCFG_SNP_EN, while the RMP is not yet in use. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not CISA KEV-listed.

Technical ContextAI

The flaw lives in the x86 AMD SEV-SNP host virtualization initialization path (x86/virt/sev). AMD SEV-SNP protects confidential guest VMs using the RMP, a firmware-managed table describing page ownership; per SNP spec section 8.8, before SNP_INIT_EX with INIT_RMP=1 the software must guarantee no CPU holds dirty cache lines for RMP memory. The regressing commit moved/removed the wbinvd_on_all_cpus() cache flush relative to enabling SNPEn, exposing a window where cache lines can migrate cache-to-cache in a dirty state and race the flush IPIs, so some dirty lines escape the WBINVD. The root cause is best described as a concurrency/incomplete-cleanup class defect (no CWE assigned in the feed; conceptually CWE-459 Incomplete Cleanup combined with a race condition), specific to AMD EPYC processors running SNP host code.

RemediationAI

Vendor-released patch: upgrade to Linux stable 7.1.5 (or 7.2-rc3 / later), which reverts the regressing commit so wbinvd_on_all_cpus() executes before MSR_AMD64_SYSCFG_SNP_EN is set; apply the corresponding stable commits from git.kernel.org (4c2509f3b7975... and e5158ff53fdff...). Because this is a boot-time SNP initialization fix, the only reliable remediation is patching and rebooting the affected hosts - there is no runtime toggle that safely re-flushes the RMP after the fact. As a compensating control until patched, operators can avoid enabling SEV-SNP host support (do not set SNP on in kernel/BIOS) or refrain from bringing confidential guests into production on the affected kernels; the trade-off is loss of SEV-SNP confidential-VM functionality. Reference advisories: https://nvd.nist.gov/vuln/detail/CVE-2026-72239 and the stable kernel commit links above.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72239 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72239

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code