Skip to main content

Linux Kernel CVE-2026-72425

| EUVDEUVD-2026-59324 HIGH
2026-08-15 Linux GHSA-cwxj-gwrv-324j
Information Disclosure Linux Red Hat Suse
High
Disputed · 7.1 Vendor: Linux
Share

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

PR:L over provided PR:N because triggering the full leak chain requires at minimum guest VM access; S:C retained as guest-configured FDIR conditions cascade to host kernel resource exhaustion.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:20 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.1 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:56 cve.org
HIGH 7.1
CVE Published
Aug 15, 2026 - 05:56 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()

Resetting all VFs causes resource leak on VFs with FDIR filters enabled as CTRL VSIs are only invalidated and not freed. Fix by using ice_vf_ctrl_vsi_release() instead of ice_vf_ctrl_invalidate_vsi() which aligns behavior with the ice_reset_vf() function.

Reproduction: echo 1 > /sys/class/net/$pf/device/sriov_numvfs ethtool -N $vf flow-type ether proto 0x9000 action 0 echo 1 > /sys/class/net/$pf/device/reset

AnalysisAI

Resource exhaustion in the Linux kernel ice driver allows accumulated CTRL VSI memory leaks during VF resets on Intel E800-series adapters with FDIR filters active, ultimately degrading host availability after repeated VF lifecycle operations. Affected kernel versions span from the introducing commit (da62c5ff9dcd) through all stable branches prior to the fix commits, with patched releases confirmed at 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. No public exploit tool exists and EPSS is a negligible 0.21% (12th percentile), placing this squarely in the patch-when-convenient tier for most deployments - with the exception of high-density SR-IOV virtualization hosts running frequent VF resets, where the cumulative leak poses a realistic availability risk.

Technical ContextAI

The ice driver supports Intel E800-series Ethernet adapters (e.g., E810) that implement SR-IOV, enabling a single physical NIC (PF) to be partitioned into Virtual Functions (VFs) for guest VMs. FDIR (Flow Director) is a hardware acceleration feature that steers packets at the NIC level based on flow rules; each VF with active FDIR rules maintains a dedicated CTRL VSI (Control Virtual Switch Interface) resource handle in the kernel. The bug resides in ice_reset_all_vfs(): it calls ice_vf_ctrl_invalidate_vsi() which only NULLs the CTRL VSI pointer without releasing the underlying hardware resource, whereas the per-VF equivalent ice_reset_vf() correctly calls ice_vf_ctrl_vsi_release() to free it. This is a code-path inconsistency, not a design flaw - the correct resource management pattern already existed in the codebase. No CWE is formally assigned, but this maps to CWE-772 (Missing Release of Resource after Effective Lifetime). The 'Information Disclosure' tag appearing in the source intelligence is inconsistent with both the CVE description and the CVSS vector (C:N/I:N/A:H) and should be disregarded.

RemediationAI

The primary remediation is upgrading the Linux kernel to a patched release: 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or any later release; distributions maintaining their own stable kernels (RHEL, Ubuntu, SUSE) should be monitored for backport advisories incorporating these commits. For environments where a kernel update is not immediately feasible, a targeted workaround is to remove all active FDIR flow rules from VFs before executing VF resets - use ethtool -N $vf delete <rule-id> for each active rule prior to triggering a reset via sysfs or management tooling; this eliminates the CTRL VSI leak path at the cost of temporarily losing hardware flow steering. A broader but more disruptive workaround is to disable SR-IOV entirely (echo 0 > /sys/class/net/$pf/device/sriov_numvfs) before maintenance resets, then re-enable afterward; this prevents the leak entirely but interrupts all VF-dependent workloads during the window. Neither workaround requires a reboot. Patch availability is confirmed by the Linux kernel stable team via multiple backport commits referenced above.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72425 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy