Skip to main content

Linux Kernel CVE-2026-72393

| EUVDEUVD-2026-59292 CRITICAL
2026-08-15 Linux GHSA-h6c6-rxf5-q7rw
Information Disclosure Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.3 MEDIUM

Triggered on the local TX path (AV:L) with timing-dependent head reallocation (AC:H) by a local traffic sender (PR:L); primary impact is a kernel crash (A:H) with limited info leak (C:L).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:02 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.8 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:56 cve.org
CRITICAL 9.8
CVE Published
Aug 15, 2026 - 05:56 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

eth: fbnic: don't cache shinfo across skb realloc

fbnic_tx_lso() calls skb_cow_head() which may reallocate the skb including the shared info. We can't use the pointer calculated before the call.

BUG: KASAN: slab-use-after-free in fbnic_tx_lso.isra.0+0x668/0x8e0 Read of size 4 at addr ff110000262edd98 by task swapper/5/0 Call Trace: fbnic_tx_lso.isra.0+0x668/0x8e0 fbnic_xmit_frame+0x622/0xba0 dev_hard_start_xmit+0xf4/0x620

Allocated by task 8653: __alloc_skb+0x11e/0x5f0 alloc_skb_with_frags+0xcc/0x6c0 sock_alloc_send_pskb+0x327/0x3f0 __ip_append_data+0x188b/0x47a0 ip_make_skb+0x24a/0x300 udp_sendmsg+0x14d2/0x21e0

Freed by task 0: kfree+0x123/0x5a0 pskb_expand_head+0x36c/0xfa0 fbnic_tx_lso.isra.0+0x500/0x8e0 fbnic_xmit_frame+0x622/0xba0 dev_hard_start_xmit+0xf4/0x620 sch_direct_xmit+0x25b/0x1100

The buggy address belongs to the object at ff110000262edc40 which belongs to the cache skbuff_small_head of size 640 The buggy address is located 344 bytes inside of freed 640-byte region [ff110000262edc40, ff110000262ede

AnalysisAI

Memory corruption (use-after-free) in the Linux kernel's fbnic Ethernet driver occurs on the transmit path when fbnic_tx_lso() caches a pointer into the skb shared-info region and then calls skb_cow_head(), which may reallocate the skb and free the original buffer. Any host equipped with Meta's fbnic NIC that transmits large-segmentation-offload (LSO/TSO) traffic can trigger a slab-use-after-free, reading freed skbuff memory and potentially crashing the kernel. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%), and the issue is not in CISA KEV.

Technical ContextAI

The affected component is fbnic, the in-tree driver for Meta's (Facebook) proprietary data-center network interface controller, introduced around Linux 6.15. The root cause is a stale-pointer / use-after-free class defect (CWE-416, though the feed lists CWE as N/A): fbnic_tx_lso() computes a pointer derived from skb_shinfo() (the skb shared-info trailer) before invoking skb_cow_head(). skb_cow_head()/pskb_expand_head() can reallocate the head, freeing the original 640-byte skbuff_small_head slab object; the previously cached shinfo pointer then references freed memory, as confirmed by the KASAN report showing a 4-byte read 344 bytes into a freed region. The triggering allocation in the trace originates from udp_sendmsg → ip_make_skb, i.e. ordinary local TX traffic exercising the LSO code path.

RemediationAI

Patch available per vendor advisory: apply the stable kernel updates that fix the cached-shinfo use-after-free, which reload the shared-info pointer after skb_cow_head(). Upstream fixes are the stable commits 83df3e2594cd78aa40b1246a19879abb4891945b, 21f304c2aae46625e050c28d979f4b9d83faa85e and 62b68b774f06bf52e329f254f0199bc43d350ccf (https://git.kernel.org/stable/c/83df3e2594cd78aa40b1246a19879abb4891945b), corresponding to fixed releases such as 6.18.40 and the 7.1.5/7.2-rc2 stable trees. Because the bug is confined to the fbnic transmit path, the most targeted compensating control on unpatched systems is to avoid the affected hardware/driver - hosts without an fbnic NIC are not exposed. Disabling TCP/generic segmentation offload on the fbnic interface (e.g. ethtool -K <iface> tso off gso off) would avoid the LSO code path that dereferences the stale pointer, at the cost of reduced transmit throughput and higher CPU utilization; treat this only as an interim measure until the kernel is upgraded.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-72393 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy