Skip to main content

Linux Kernel CVE-2026-72298

| EUVDEUVD-2026-59197 HIGH
2026-08-15 Linux GHSA-3c34-q5w8-c59m
Buffer Overflow Linux Red Hat Suse
8.4
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.4 HIGH

AV:L confirmed by QRTR's local IPC architecture; PR:N consistent with AF_QIPCRTR accessibility to unprivileged users per official vector; full CIA impact appropriate for kernel heap overflow.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 08:17 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.4 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:55 cve.org
HIGH 8.4
CVE Published
Aug 15, 2026 - 05:55 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()

qrtr_endpoint_post() validates an incoming packet with

if (!size || len != ALIGN(size, 4) + hdrlen) goto err;

where size comes from the wire. On 32-bit, size_t is 32 bits and ALIGN(size, 4) wraps to 0 for size >= 0xfffffffd, so the check passes and skb_put_data(skb, data + hdrlen, size) writes past the hdrlen-sized skb and oopses the kernel. 64-bit is unaffected.

This is the 32-bit residual of ad9d24c9429e2 ("net: qrtr: fix OOB Read in qrtr_endpoint_post"), which fixed only the 64-bit case.

Reject any size that cannot fit the buffer before the ALIGN.

AnalysisAI

Integer overflow in the Linux kernel's QRTR (Qualcomm IPC Router) subsystem on 32-bit platforms allows an out-of-bounds kernel heap write via a crafted incoming packet. On 32-bit builds where size_t is four bytes, passing size >= 0xfffffffd to ALIGN(size, 4) wraps the result to zero, bypassing the packet validation check in qrtr_endpoint_post() and allowing skb_put_data() to write attacker-controlled data far beyond the allocated socket buffer. This is the 32-bit residual of commit ad9d24c9429e2, which fixed only the 64-bit case; 64-bit kernels are structurally unaffected. No public exploit is identified at time of analysis, and EPSS at 0.22% reflects low exploitation probability.

Technical ContextAI

The vulnerability is in net/qrtr/qrtr.c, specifically qrtr_endpoint_post(), which is called by QRTR transport drivers to process inbound IPC packets on Qualcomm-based hardware (AF_QIPCRTR socket family). The root cause is CWE-190 (Integer Overflow or Wraparound): on 32-bit kernels, size_t is a 4-byte unsigned integer, so ALIGN(size, 4) computes (size + 3) & ~3 - which wraps to zero for size values of 0xfffffffd, 0xfffffffe, or 0xffffffff. The guard condition 'len != ALIGN(size, 4) + hdrlen' therefore evaluates to 'len != hdrlen', which can pass if the attacker also controls the reported length field. The subsequent skb_put_data(skb, data + hdrlen, size) then copies 'size' bytes into an skb allocated only for hdrlen bytes, producing a heap out-of-bounds write (CWE-787) that oopses or corrupts the kernel. Affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* across multiple stable branches. 64-bit systems are immune because size_t is eight bytes and ALIGN cannot wrap for any realistic packet size.

RemediationAI

Upgrade to a patched stable kernel release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or the upstream 7.2-rc1. Individual patch commits are available at https://git.kernel.org/stable/c/3665e644ea081c4624a1637023b0de3b29f4ae04, https://git.kernel.org/stable/c/242408b5b763c01288adf3113cbce84378a76e1a, https://git.kernel.org/stable/c/b609f7f46916c6b05585ca82455077198a23770f, and related commits listed in the references. Distribution-specific packages (Debian, Ubuntu, RHEL, OpenWRT, Android BSP) should be applied as soon as they are published. If immediate kernel upgrade is not feasible on a 32-bit system, unloading the qrtr module via 'modprobe -r qrtr' eliminates the attack surface entirely - but this disables modem IPC on Qualcomm platforms, which will break cellular connectivity on mobile or modem-dependent systems. As a narrower mitigation, restricting AF_QIPCRTR socket creation to privileged users through seccomp profiles or LSM (SELinux/AppArmor) policy reduces the risk from unprivileged local attackers without disabling the subsystem entirely, though the efficacy depends on whether the exploit path is via user-space sockets or the modem transport layer.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-72298 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy