Skip to main content

Linux Kernel CVE-2026-72352

| EUVDEUVD-2026-59251 HIGH
2026-08-15 Linux GHSA-p43j-9ghf-j8hh
Buffer Overflow Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local vector and PR:L confirmed by BPF program loading requiring at least low-privilege account; integer overflow in kernel yields full C/I/A impact with no user interaction.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.7 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 08:41 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:55 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 05:55 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

HID: bpf: Fix hid_bpf_get_data() range check

hid_bpf_get_data() returns a pointer into the HID-BPF context data when the caller-provided offset and size fit inside ctx->allocated_size.

The current check adds rdwr_buf_size and offset before comparing the result against ctx->allocated_size. Since both values are unsigned, a very large size can wrap the sum below ctx->allocated_size and make the helper return a pointer even though the requested range is not contained in the backing buffer.

Use check_add_overflow() to reject wrapped range ends before comparing the requested range end against ctx->allocated_size.

AnalysisAI

Integer wraparound in the Linux kernel HID-BPF subsystem's hid_bpf_get_data() helper allows a local low-privileged user to bypass a buffer range check and obtain an out-of-bounds pointer into kernel memory, potentially enabling privilege escalation or memory corruption. Affected kernels span from Linux 6.3 (commit 658ee5a64fcfbbf) through versions prior to 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3, where upstream fix commits have landed. No public exploit has been identified at time of analysis and EPSS remains at 0.21%, but the CVSS 7.8 local-privilege score reflects a high-impact, low-complexity code path once local access is established.

Technical ContextAI

The vulnerable code resides in the Linux kernel's HID-BPF subsystem - a facility that allows eBPF programs to attach to Human Interface Device (HID) events and manipulate device data buffers. The hid_bpf_get_data() helper is designed to return a validated pointer into the HID-BPF context buffer (ctx->allocated_size) only when the caller-supplied offset and rdwr_buf_size fall within that allocation. The root cause is an unsigned integer addition: rdwr_buf_size + offset can wrap around (classic unsigned integer overflow) to a value smaller than ctx->allocated_size, causing the comparison to pass falsely and returning an out-of-bounds pointer. The fix substitutes check_add_overflow(), which detects the wraparound before the comparison. The CWE is not formally assigned in the input, but the class maps to CWE-190 (Integer Overflow or Wraparound) manifesting as an out-of-bounds read/write. The affected CPE is cpe:2.3:a:linux:linux:* for kernel versions from the introducing commit in Linux 6.3 onward until patched stable branches.

RemediationAI

The primary remediation is to upgrade the Linux kernel to a patched version: 6.12.97, 6.18.40, 7.1.5, or 7.2-rc3, as confirmed by the upstream stable tree commits referenced at https://git.kernel.org/stable/c/ca373549140dfb386aa2de38364b58441b1f4885 and related links. For systems where immediate kernel upgrade is not operationally feasible, the most effective compensating control is to set kernel.unprivileged_bpf_disabled=1 via sysctl (sysctl -w kernel.unprivileged_bpf_disabled=1), which prevents unprivileged users from loading BPF programs and eliminates the attack path; note this will break unprivileged BPF-dependent tooling such as some network monitoring utilities. On systems where HID-BPF is compiled as a module, running modprobe -r hid-bpf removes the vulnerable code path entirely at the cost of disabling BPF-based HID device customization. SELinux and AppArmor policies restricting bpf() syscall access to explicitly authorized processes provide an additional layer of containment without disabling the feature globally.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72352 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy