What is the CVSS score of CVE-2026-72345?

CVE-2026-72345 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72345?

A kernel vulnerability in Mellanox/NVIDIA ConnectX network drivers (CVE-2026-72345) allows local attackers to gain administrative privileges on affected systems.. A patch is available.

How to fix or mitigate CVE-2026-72345?

Within 24 hours: Inventory all production systems running Linux with Mellanox/NVIDIA ConnectX NICs and prioritize those supporting multi-tenant environments or hosting untrusted workloads. Within 7 days: Deploy vendor-released kernel patches to all identified systems, starting with production infrastructure and systems where local user access is permitted; coordinate with infrastructure teams to schedule updates during maintenance windows. Within 30 days: Complete patching across all remaining systems and validate through kernel integrity checks and access control audits to confirm privilege escalation paths are closed.

Linux Kernel CVE-2026-72345

EUVD-2026-59244 HIGH

2026-08-15 Linux

GHSA-2cj4-xv36-4974

Information Disclosure Linux Red Hat Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Exploitation requires mlx5 hardware, single-FDB LAG configuration, and triggering a specific error condition mid-loop, raising AC to H versus the provided AC:L.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

4.7 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 08:37 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:55 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 05:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: LAG, Fix off-by-one in single-FDB error rollback

On failure at index i, the reverse cleanup loop in mlx5_lag_create_single_fdb() starts from i, so the failed index itself is rolled back. That can operate on uninitialized state or double-tear-down a rule the add_one path already self-rolled-back.

Start the rollback from i - 1 so only successfully-installed entries are undone.

AnalysisAI

Off-by-one memory corruption in the Linux kernel's mlx5 LAG (Link Aggregation) subsystem exposes systems with Mellanox/NVIDIA ConnectX NICs to local privilege escalation via a defective error rollback loop in mlx5_lag_create_single_fdb(). When rule installation fails at index i, the cleanup loop incorrectly begins teardown at i rather than i-1, operating on uninitialized kernel state or double-freeing a rule the add_one path already rolled back - resulting in heap corruption with C:H/I:H/A:H impact potential. No public exploit or CISA KEV listing exists at time of analysis; EPSS probability stands at 0.20% (10th percentile), and upstream fix commits are confirmed available.

Technical ContextAI

The mlx5_core driver services Mellanox (now NVIDIA) ConnectX Ethernet adapters and is included in mainline Linux. Link Aggregation Group (LAG) support in this driver allows bonding multiple physical ports into a single logical interface. In single-FDB (Forwarding Database) mode, a shared forwarding table is installed across bonded ports by iterating mlx5_lag_add_one() over each port. The off-by-one resides in the error rollback path: on failure at index i, the reverse cleanup loop starts from i itself. Because the add_one() call at i already failed (and may have self-cleaned), the rollback either operates on uninitialized kernel memory or executes a double-teardown of a rule object - both represent kernel-heap memory-safety violations. While no CWE is formally assigned in the input, the root cause maps to CWE-193 (Off-by-One Error) in an error-handling code path, which is a recurring vulnerability class in Linux kernel driver cleanup routines. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covering the commit range ddbb5ddc43ad through the fix commits.

RemediationAI

Upgrade to Linux kernel 7.1.5 or 7.2-rc3 (or any later stable release), which incorporate fix commits 40cc06bf71476932e5d139fa326dcd0372766e16 and 0f0e4ae6975c773f7854fc48932a267f6c79088f (https://git.kernel.org/stable/c/40cc06bf71476932e5d139fa326dcd0372766e16). Distribution-specific kernel packages for RHEL, Debian, Ubuntu, and SUSE should be monitored for backported fixes to their supported kernel series. If patching is not immediately feasible, disable LAG/bonding in single-FDB mode on mlx5 interfaces - specifically, avoid configuring mlx5_core-based bonds in single-FDB topology; this eliminates the vulnerable code path entirely at the cost of losing link aggregation on ConnectX adapters. Additionally, restrict CAP_NET_ADMIN capability via AppArmor, SELinux, or seccomp profiles to limit which local users can configure network interfaces, reducing the pool of potential attackers while the patch is staged. Note that disabling bonding may impact network throughput and redundancy in high-availability configurations.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72345 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72345

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code