What is the CVSS score of CVE-2026-72412?

CVE-2026-72412 has a contested CVSS base score of 9.3 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-72412?

Linux kernel CVE-2026-72412 creates a critical data-integrity risk in IBM Z (s390) systems running KVM hypervisors, where a kernel defect can silently corrupt guest virtual-machine data without…

How to fix or mitigate CVE-2026-72412?

Within 24 hours: Identify all IBM Z (s390) systems running Linux KVM hypervisors and collect precise kernel version information using uname -r or your configuration management system. Within 7 days: Cross-reference identified systems against vulnerable kernel versions (before 7.1.5 and any 7.2-rc series); document affected systems and escalate to IBM/Red Hat support for interim guidance and mitigation options. Within 30 days: Coordinate with your vendor on a patching and deployment timeline; in the interim, apply host-level security hardening (SELinux, RBAC), enable guest VM monitoring for data inconsistencies, and evaluate whether affected workloads can be temporarily migrated to verified-unaffected platforms.

Linux Kernel CVE-2026-72412

EUVD-2026-59311 CRITICAL

2026-08-15 Linux

GHSA-94jh-p9fj-qxf8

Information Disclosure Linux Red Hat Suse

Critical

Disputed · 9.3 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.7 HIGH

Local s390 KVM host only, with timing-dependent memory reuse (AC:H) and a need to run guest workloads (PR:L); primary impact is guest integrity/availability, confidentiality incidental (C:L).

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 09:12 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.3 (CRITICAL)

CVE Published

Aug 15, 2026 - 05:56 cve.org

CRITICAL 9.3

CVE Published

Aug 15, 2026 - 05:56 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

s390/mm: Fix handling of _PAGE_UNUSED pte bit

The _PAGE_UNUSED softbit should not really be lying around. Its sole purpose is to signal to try_to_unmap_one() and try_to_migrate_one() that the page can be discarded instead of being moved / swapped.

KVM has no way to know why a page is being unmapped, so it sets the bit on userspace ptes corresponding to unused guest pages every time they get unmapped. KVM has no reasonable way to clear the bit once the page is in use again.

While set_ptes() checks and clears the bit, other paths that set new ptes did not. This led to used pages being thrown out as if they were unused, causing guest corruption.

Fix the issue by clearing the _PAGE_UNUSED bit for present ptes in set_pte(), i.e. whenever a present pte is getting set. The check in set_ptes() is then redundant and can be removed.

Also fix gmap_helper_try_set_pte_unused() to only set the bit if the pte is present; the _PAGE_UNUSED bit is only defined for present ptes and thus should not be set for non-present ptes.

AnalysisAI

Guest memory corruption in the Linux kernel's s390 (IBM Z) memory-management code, where mishandling of the _PAGE_UNUSED software PTE bit causes in-use KVM guest pages to be discarded as if unused. On s390 KVM hosts running kernels before 7.1.5 (and 7.2-rc series before the fix), the bit set by KVM on unmapped guest pages was not cleared by all PTE-setting paths, so a page returned to use could later be silently dropped - corrupting guest state. There is no public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and it is not in CISA KEV.

Technical ContextAI

The issue lives in s390-specific virtual-memory handling (arch/s390/mm) within the KVM/gmap subsystem for IBM Z mainframes. _PAGE_UNUSED is a software-defined bit valid only for present PTEs; its purpose is to tell try_to_unmap_one() and try_to_migrate_one() that a page may be discarded rather than migrated or swapped. KVM sets this bit on userspace PTEs for unused guest pages at unmap time but cannot know when a page is reused, so it cannot reliably clear it. set_ptes() cleared the bit, but other present-PTE-setting paths (set_pte) did not, leaving stale UNUSED markers on live pages. The CWE is not assigned, but the root cause is a state/flag-management error (stale metadata on a reused resource) leading to incorrect page reclamation. The affected CPE is generically cpe:2.3:a:linux:linux, but the defect is confined to the s390 architecture with KVM/gmap in use.

RemediationAI

Upgrade to a fixed stable kernel - Vendor-released patch: 7.1.5 (or 7.2-rc1 / later on the development branch), which applies the upstream fix that clears _PAGE_UNUSED for present PTEs in set_pte() and restricts gmap_helper_try_set_pte_unused() to present PTEs only. The fix commits are https://git.kernel.org/stable/c/fda07c8e4b54b9105f1ca73f0adea7b244d405f4 and https://git.kernel.org/stable/c/d4bb00704a66024502261fa7a523c07420249fea; see also the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-72412. There is no clean feature-flag workaround because the bug is in core PTE handling; if patching must be deferred, the only meaningful compensating control is to avoid the affected path by not running KVM guests on unpatched s390 hosts (or migrating those guests to patched hosts), accepting the trade-off of reduced consolidation, and to monitor guests for memory-corruption/crash symptoms in the interim.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-72412 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72412

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code