What is the CVSS score of CVE-2026-72344?

CVE-2026-72344 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72344?

Mellanox/NVIDIA mlx5 network drivers on Linux systems are vulnerable to a kernel crash during device teardown when configured in Link Aggregation mode, potentially causing unplanned network outages.. A patch is available.

How to fix or mitigate CVE-2026-72344?

Within 24 hours, identify all Linux systems in your environment running Mellanox/NVIDIA mlx5 network interface cards configured in Link Aggregation Group (LAG) mode and prioritize them for patching. Over the next 7 days, obtain the vendor-released patch from Mellanox/NVIDIA and test it in a staging environment that mirrors your production LAG configuration to validate stability before broader deployment. By 30 days, deploy the patched driver version to all affected production systems, coordinating with network operations to minimize disruption during updates.

Linux Kernel CVE-2026-72344

EUVD-2026-59243 HIGH

2026-08-15 Linux

GHSA-p5q5-g8w9-fgw6

Denial Of Service Linux Red Hat Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.6 MEDIUM

Device teardown and PCI removal require root/admin privileges (PR:H); primary confirmed impact is kernel crash (A:H); C:L/I:L reflects theoretical but unconfirmed memory exposure beyond DoS.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H

4.0 AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

SUSE

4.1 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 08:37 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:55 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 05:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable

mlx5_lag_get_dev_seq() will return error when the peer isn't in the LAG or when no device is marked as master. Result bad memory access and kernel crash[1].

Hence, skip the peer when lookup fails.

Note: In case there are peer flows, they are cleaned before LAG cleared the master mark.

[1] RIP: 0010:mlx5e_tc_del_fdb_peers_flow+0x3d/0x350 [mlx5_core] Call Trace: <TASK> mlx5e_tc_clean_fdb_peer_flows+0xc1/0x130 [mlx5_core] mlx5_esw_offloads_unpair+0x3a/0x400 [mlx5_core] mlx5_esw_offloads_devcom_event+0xee/0x360 [mlx5_core] mlx5_devcom_send_event+0x7a/0x140 [mlx5_core] mlx5_esw_offloads_devcom_cleanup+0x2f/0x90 [mlx5_core] mlx5e_tc_esw_cleanup+0x28/0xf0 [mlx5_core] mlx5e_rep_tc_cleanup+0x19/0x30 [mlx5_core] mlx5e_cleanup_uplink_rep_tx+0x36/0x40 [mlx5_core] mlx5e_cleanup_rep_tx+0x55/0x60 [mlx5_core] mlx5e_detach_netdev+0x96/0xf0 [mlx5_core] mlx5e_netdev_change_profile+0x5b/0x120 [mlx5_core] mlx5e_netdev_attach_nic_profile+0x1b/0x30 [mlx5_core] mlx5e_vport_rep_unload+0xdd/0x110 [mlx5_core] __esw_offloads_unload_rep+0x81/0xb0 [mlx5_core] mlx5_eswitch_unregister_vport_reps+0x1d7/0x220 [mlx5_core] mlx5e_rep_remove+0x22/0x30 [mlx5_core] device_release_driver_internal+0x194/0x1f0 bus_remove_device+0xe8/0x1b0 device_del+0x159/0x3c0 mlx5_rescan_drivers_locked+0xbc/0x2d0 [mlx5_core] mlx5_unregister_device+0x54/0x80 [mlx5_core] mlx5_uninit_one+0x73/0x130 [mlx5_core] remove_one+0x78/0xe0 [mlx5_core] pci_device_remove+0x39/0xa0

AnalysisAI

Kernel crash via bad memory access in the mlx5e traffic control peer flow cleanup path affects Linux systems running Mellanox/NVIDIA mlx5 NICs in LAG (Link Aggregation Group) mode. When mlx5_lag_get_dev_seq() returns an error during device teardown - because the peer is absent from the LAG or no master device is marked - the driver proceeds to dereference an invalid pointer in mlx5e_tc_del_fdb_peers_flow, causing a kernel panic. No public exploit exists and EPSS is 0.20% (10th percentile), but the crash is deterministically reproducible on affected hardware configurations during device removal or driver teardown sequences.

Technical ContextAI

The vulnerability resides in the mlx5_core Linux kernel module, specifically within the TC (Traffic Control) FDB (Forwarding Database) peer flow cleanup subsystem used for SR-IOV eSwitch offload on Mellanox/NVIDIA ConnectX adapters. When mlx5 NICs are bonded in LAG mode, the driver tracks peer flows across devices; during teardown via mlx5_esw_offloads_unpair, mlx5_lag_get_dev_seq() is called to retrieve device sequence information for each peer. If the peer is not present in the LAG or no device holds the master mark (a state that can occur when the master mark is cleared before peer flow cleanup completes), the function returns an error that the original code did not check, resulting in a dereference of an invalid or stale pointer. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. No formal CWE is assigned, but the root cause is an unchecked function return value (analogous to CWE-252 or CWE-476) in a kernel driver teardown path.

RemediationAI

Apply the upstream kernel fix: for Linux 7.1.x, upgrade to 7.1.5 or later (fix commit 7bed4af0ced82948d660205efecd551ef8bc3912, available at https://git.kernel.org/stable/c/7bed4af0ced82948d660205efecd551ef8bc3912); for mainline, upgrade to 7.2-rc3 or later (fix commit 5a95aa0198af75047d98fb72950642c89dab770f, available at https://git.kernel.org/stable/c/5a95aa0198af75047d98fb72950642c89dab770f). Distribution-specific kernel packages incorporating these stable commits should be applied via the vendor's update mechanism. As a compensating control where immediate patching is not feasible, disable hardware TC offload on affected mlx5 interfaces using 'ethtool -K <interface> hw-tc-offload off'; this prevents the vulnerable TC peer flow path from being activated, though it will reduce SR-IOV and eSwitch offload performance and may impact network throughput in high-traffic environments. Restricting local system access to trusted administrators also limits exposure given the local attack vector.

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72344 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72344

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code