Skip to main content

Linux Kernel CVE-2026-72244

| EUVDEUVD-2026-59143 HIGH
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-c4ph-4532-7vq7
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local kernel GPU allocator flaw requires low-privileged local access and GPU device node availability; memory misalignment can affect all three CIA properties within the vulnerable system scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 07:55 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

gpu/buddy: bail out of try_harder when alignment cannot be honoured

The try_harder contiguous fallback could return a range whose start offset did not match the caller's min_block_size. When a candidate's start is misaligned, realign it: free the misaligned run and reallocate exactly @size at the next lower min_block_size boundary. This keeps the returned size unchanged with no surplus to trim, and rejects the request only when no aligned candidate fits.

v2: align misaligned candidates down to min_block_size instead of bailing out, for both the RHS and LHS paths (Matthew).

AnalysisAI

Local privilege escalation in the Linux kernel's GPU buddy memory allocator (gpu/buddy) allows a low-privileged authenticated local user to exploit a misalignment logic error in the try_harder contiguous fallback path, achieving high confidentiality, integrity, and availability impact (CVSS 7.8). The defect, introduced at commit 0a1844bf0b532d84324453374ad6845f64066c28, caused the allocator to return candidate blocks whose start offsets were not aligned to the caller's min_block_size, violating allocation invariants on both the RHS and LHS paths. No public exploit identified at time of analysis; EPSS exploitation probability is 0.21% (11th percentile), consistent with low near-term exploitation likelihood.

Technical ContextAI

The affected subsystem is the Linux kernel gpu/buddy allocator, which manages contiguous GPU memory using a binary buddy allocation strategy. When a contiguous allocation cannot be satisfied on the first attempt, the try_harder fallback path searches for candidate blocks under relaxed constraints. The bug resided in the alignment enforcement step of that fallback: candidate blocks whose start offsets were not aligned to the caller's min_block_size boundary were returned without correction, rather than being realigned by freeing the misaligned run and reallocating at the next lower aligned boundary. The fix introduced in v2 of the patch corrects both the RHS and LHS candidate paths by aligning misaligned candidates down to min_block_size before returning. CWE is listed as N/A by NVD - this is a logic/alignment correctness error rather than a classical memory-safety category. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates local, low-privileged exploitation with no user interaction required. Affected kernel versions span from the introducing commit across multiple stable branches, with fixes landed in 6.12.101, 6.18.42, 7.1.5, and 7.2-rc3.

RemediationAI

Upgrade to a patched Linux kernel release: 6.12.101, 6.18.42, or 7.1.5 for stable production deployments, or 7.2-rc3 for bleeding-edge environments. These versions are confirmed as patched per EUVD data. The upstream stable commits implementing the fix are available at https://git.kernel.org/stable/c/419d7d9306491f3e0e417cf794844c73cabee090, https://git.kernel.org/stable/c/4289531106ee175a6eb45db7d4f2734d1dae9887, https://git.kernel.org/stable/c/56bc6384314fb9ae98975fb2af8b143097ede3dc, and https://git.kernel.org/stable/c/7185c5262435b93e5eeffa647008992256b9c51a. For systems where an immediate kernel upgrade is not feasible, restrict unprivileged access to GPU device nodes by tightening /dev/dri permissions via udev rules or group membership controls, preventing untrusted local users from invoking the gpu/buddy allocator - note this will deny legitimate GPU access to restricted users and is not a substitute for patching. Distribution-specific stable kernels from Red Hat, Debian, Ubuntu, and SUSE should be monitored for backport availability.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-72244 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy