Skip to main content

Linux Kernel CVE-2026-72360

| EUVDEUVD-2026-59259 HIGH
2026-08-15 Linux GHSA-g429-9jp7-485v
Information Disclosure Linux Red Hat Suse
High
Disputed · 8.4 Vendor: Linux
Share

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY
8.4 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
vuln.today AI
8.4 HIGH

Local VF guest access with low privileges required; scope changes to host PF; no confidentiality impact but high integrity and availability impact from ABI breakage and potential assert.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
SUSE
3.8 LOW
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Red Hat
5.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 08:47 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.4 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:56 cve.org
HIGH 8.4
CVE Published
Aug 15, 2026 - 05:56 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays

Currently defined VF/PF relay actions use regular REQUEST messages only and the PF shouldn't attempt to handle FAST_REQUEST nor EVENT messages as this would result in breaking the VFPF ABI protocol and also might trigger an assert on the PF side.

(cherry picked from commit 1714d360fc5ae2e0886a69e979095d9c7ff3568a)

AnalysisAI

Integrity and availability compromise in the Linux kernel's Intel Xe GPU Physical Function (PF) driver allows a low-privileged local user operating within a guest Virtual Function (VF) environment to trigger PF-side assertion failures and ABI protocol breakage by sending FAST_REQUEST or EVENT relay messages - message types the PF handler is not designed to process. The vulnerability crosses a privilege boundary from guest to host, reflected in the CVSS scope-changed rating of 8.4. No public exploit code exists and no active exploitation has been confirmed; EPSS stands at 0.21% (11th percentile). Vendor-released patches are available across multiple stable kernel branches.

Technical ContextAI

The Intel Xe GPU driver (drm/xe) implements SR-IOV (Single Root I/O Virtualization), which partitions a single physical GPU into a Physical Function (PF, controlled by the host kernel) and one or more Virtual Functions (VFs, exposed to guest VMs). PF and VF communicate via a relay protocol that defines three message types: REQUEST (the only type PF should process), FAST_REQUEST, and EVENT. The defect resides in the PF relay dispatcher, which fails to reject FAST_REQUEST and EVENT messages, instead attempting to handle them. This violates the VFPF ABI specification - the protocol contract between virtual and physical components - and can trigger a kernel-level assert on the PF side, causing a host kernel fault. CPE data identifies the affected product as cpe:2.3:a:linux:linux across multiple kernel versions. No CWE was formally assigned, but the root cause class is improper input validation in a privileged inter-domain message handler - the PF trusts message type fields from VF without enforcing the protocol's type constraints.

RemediationAI

Upgrade to a patched kernel version: Linux 6.12.97, Linux 6.18.40, Linux 7.1.5, or Linux 7.2-rc2 (or later). Fix commits are available at https://git.kernel.org/stable/c/499be4b5d64209e9f18c9442f9fbeef7155ae900, https://git.kernel.org/stable/c/adc7dda728ca3e340a413e3bbc10cf159e1866a4, https://git.kernel.org/stable/c/a4208d8032abd7f591581994f31e23b80b8fe659, and https://git.kernel.org/stable/c/ed8b0d731892c68b41ecbd27c952af284816dec1, covering multiple stable branches. If immediate patching is not possible, the primary compensating control is to disable SR-IOV VF instantiation on Intel Xe GPU devices, which eliminates the VF-to-PF relay channel entirely - this removes the attack surface but also disables GPU partitioning for guest VMs. Alternatively, restricting untrusted guest workloads from accessing SR-IOV VF devices by enforcing strict IOMMU group isolation reduces exposure, though it does not eliminate the protocol bug. Neither workaround prevents exploitation if trusted guest access with shared GPU resources is a business requirement.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72360 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy