What is the CVSS score of CVE-2026-72295?

CVE-2026-72295 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel KVM are affected by CVE-2026-72295?

A memory access flaw in Linux kernel virtualization for LoongArch systems could allow local system users to compromise the hypervisor and access sensitive kernel data, though current exploitation…. A patch is available.

How to fix or mitigate CVE-2026-72295?

Within 24 hours, inventory all LoongArch-based Linux systems running KVM to assess exposure scope. Within 7 days, apply vendor patches to affected systems: upgrade to stable kernel releases 6.18.40, 7.1.5, or 7.2-rc1 depending on your current version, prioritizing systems with higher privilege user access. Within 30 days, verify patch deployment across all systems, audit KVM access controls to restrict local user privileges where possible, and implement monitoring for anomalous KVM module activity as a secondary control.

Linux Kernel KVM CVE-2026-72295

EUVD-2026-59194 HIGH

2026-08-15 Linux

GHSA-xrj6-m35p-fmrw

Information Disclosure Linux Red Hat Suse

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Local KVM access at low privilege (kvm group) is sufficient; no complex preconditions beyond /dev/kvm access; scope change to host kernel consistent with hypervisor boundary crossing.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 08:14 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:55 cve.org

HIGH 8.8

CVE Published

Aug 15, 2026 - 05:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: KVM: Validate irqchip index in irqfd routing

Sashiko reported that the irqchip index is not validated for LoongArch. Add validation and reject out-of-range irqchip indexes to avoid indexing past the routing table's chip array.

AnalysisAI

Out-of-bounds array indexing in the Linux kernel's KVM irqfd routing for LoongArch allows a local user with KVM access to index past the routing table's chip array boundary, potentially exposing host kernel memory or enabling a hypervisor boundary breach with full triad impact. Patches are available in stable releases 6.18.40, 7.1.5, and 7.2-rc1 across three upstream commits. No public exploit code exists and EPSS sits at 0.21% (11th percentile), indicating negligible active exploitation probability despite the elevated CVSS 8.8 score.

Technical ContextAI

The vulnerability resides in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem on LoongArch - a MIPS-derived CPU ISA developed by Loongson Technology, used primarily in Chinese enterprise and government hardware. The irqfd mechanism (exposed via the KVM_IRQFD ioctl) allows userspace VMMs to map eventfd file descriptors to virtual interrupt injections into guest VMs. During irqfd routing, the kernel resolves an irqchip index to locate the appropriate virtual interrupt controller entry in the routing table's chip array. On LoongArch specifically, this index was not bounds-checked before use, meaning a caller supplying an out-of-range value causes the kernel to access memory beyond the chip array. The CPE identifier cpe:2.3:a:linux:linux:* identifies the mainline Linux kernel as the affected component. No CWE is formally assigned, but the root cause maps directly to CWE-129 (Improper Validation of Array Index).

RemediationAI

Upgrade to a fixed kernel release: Linux 6.18.40, 7.1.5, or 7.2-rc1, which include the bounds-validation patches referenced at https://git.kernel.org/stable/c/199b570d7fca1aa70e596f10a6276997becffb6d, https://git.kernel.org/stable/c/8b3e188d19e4ffe916780aeb7ddad9d6457b8bcc, and https://git.kernel.org/stable/c/3474037904c20ff915e3ebab0ab5c1e41bbe549e. If immediate kernel upgrade is not feasible on LoongArch KVM hosts, restrict access to /dev/kvm exclusively to trusted VMM processes using filesystem ACLs or cgroup device policies, which blocks untrusted local users from invoking KVM_IRQFD with crafted irqchip indexes; the trade-off is that this prevents any non-whitelisted virtualization tooling from functioning. On non-virtualization workloads, disabling the KVM kernel module entirely (modprobe -r kvm_loongarch) eliminates the attack surface with no operational impact.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72295 vulnerability details – vuln.today

Back

Linux Kernel KVM CVE-2026-72295

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code