What is the CVSS score of CVE-2026-72291?

CVE-2026-72291 has a contested CVSS base score of 9.3 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-72291?

A critical vulnerability in the Linux kernel's s390 KVM subsystem affects IBM Z mainframe systems running virtualization, potentially allowing local attackers to escalate privileges and access…. A patch is available.

How to fix or mitigate CVE-2026-72291?

Within 24 hours, identify all s390 KVM-enabled systems in your mainframe environment and assess current kernel patch levels. Within 7 days, apply the upstream kernel patch to all production mainframe systems and validate system functionality. Within 30 days, extend patching to all non-production environments and verify remediation through security scanning.

Linux Kernel CVE-2026-72291

EUVD-2026-59190 CRITICAL

2026-08-15 Linux

GHSA-vqgj-mcrm-863f

Information Disclosure Linux Red Hat Suse

Critical

Disputed · 9.3 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Race requires local code execution (AV:L) and winning a narrow timing window (AC:H) with some privilege to drive guest/host operations (PR:L); scope changes across the virtualization boundary (S:C) with full impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 08:12 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.3 (CRITICAL)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:55 cve.org

CRITICAL 9.3

CVE Published

Aug 15, 2026 - 05:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390: Fix unlikely race in try_get_locked_pte()

Fix an unlikely race in try_get_locked_pte(), which could have happened if puds or pmds get unmapped between the p?dp_get() and p?d_offset() functions.

AnalysisAI

Local privilege/information-disclosure risk in the Linux kernel's s390 KVM subsystem stems from an unlikely race in try_get_locked_pte(), where puds or pmds can be unmapped between the p?dp_get() and p?d_offset() calls, leaving code operating on a stale or freed page-table entry. The flaw affects s390 (IBM Z mainframe) systems running KVM virtualization and has now been patched upstream; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.20%, 10th percentile).

Technical ContextAI

The vulnerability lives in the s390 architecture's KVM guest memory-management path, specifically try_get_locked_pte(), which walks the multi-level page-table hierarchy (PGD → PUD → PMD → PTE) to obtain and lock a page-table entry. The bug is a time-of-check/time-of-use race: between reading a directory entry with p?dp_get() and dereferencing it with p?d_offset() to descend a level, a concurrent unmap of the pud or pmd can invalidate the entry, so the offset computation is performed against memory that is being torn down. This is characteristic of a concurrency/use-after-free-adjacent flaw (CWE was not assigned in the input, but the pattern maps to CWE-362 race condition, potentially leading to CWE-416 use-after-free). Per the CPE data the affected component is the generic 'linux:linux' product, but the code path is s390-specific and only reachable on IBM Z hardware running KVM.

RemediationAI

Apply the upstream kernel fix: update to a stable kernel that includes commits ce587046baacdeb774b7756ab29b3f594e429004 and 5670b7f927f8d98685f3f5873dbf9f8d7a5a63f3 (Vendor-released patch corresponding to the ~7.1.5 stable and 7.2-rc1 lines), or the equivalent backport shipped by your distribution - rebuild/reboot into the patched kernel to take effect. The patch commits are at https://git.kernel.org/stable/c/ce587046baacdeb774b7756ab29b3f594e429004 and https://git.kernel.org/stable/c/5670b7f927f8d98685f3f5873dbf9f8d7a5a63f3. Because the flaw is confined to s390 KVM, non-s390 systems are not affected and need no action. Where immediate patching is not possible on IBM Z hosts, the practical compensating control is to restrict who can launch or interact with KVM guests and limit untrusted local/guest workloads on affected hosts, since exploitation requires local execution to drive the race; note this reduces exposure but does not close the window, and there is no feature-level toggle that disables the vulnerable page-table path without disabling KVM itself.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72291 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72291

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code