Skip to main content

Linux Kernel CVE-2026-72434

| EUVDEUVD-2026-59333 HIGH
2026-08-15 Linux GHSA-c7hq-44p5-58fg
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition exploitation requires winning precise kernel-timing between GC re-queue and destroy-path cancel, warranting AC:H over the vendor's AC:L.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:23 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:56 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 05:56 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: make sure gc is properly stopped

Sashiko noticed that when destroying a set, cancel_delayed_work_sync() was called while gc calls queue_delayed_work() unconditionally which can lead not to properly shutting down the gc.

AnalysisAI

Privilege escalation in the Linux kernel's netfilter ipset subsystem stems from a race condition between the garbage collector (GC) and set destruction logic, where queue_delayed_work() is called unconditionally inside the GC callback while cancel_delayed_work_sync() is called during set teardown, allowing the GC to run against freed memory. Affected kernel versions span from 5.4.24 through mainline prior to the fix commits, with patches backported to stable series 6.12.97 and 6.18.40. No public exploit code exists and the CVE is not listed in CISA KEV, but the CVSS 7.8 local-privilege-escalation impact reflects the potential for kernel heap corruption reachable by low-privileged local users.

Technical ContextAI

The flaw is in the Linux kernel's netfilter/ipset subsystem, which manages IP address sets used by iptables and nftables for efficient packet classification. The GC (garbage collector) in ipset uses the kernel workqueue mechanism, scheduling periodic cleanup via queue_delayed_work(). During ipset destruction, the teardown path calls cancel_delayed_work_sync() to halt the GC, but the GC callback re-queues itself unconditionally before checking whether it should stop. This creates a time-of-check-to-time-of-use (TOCTOU) race: the GC may re-queue itself after cancellation has been issued, executing against a partially or fully deallocated set structure. The result is a use-after-free class vulnerability in kernel memory. The affected CPE (cpe:2.3:a:linux:linux:*) encompasses the broad Linux kernel version range. No CWE was formally assigned, but the flaw maps to CWE-362 (Race Condition) and CWE-416 (Use After Free). Fix commits are available on kernel.org stable branches.

RemediationAI

The primary fix is upgrading to a patched kernel version. Confirmed patched stable releases per EUVD are Linux 6.12.97, 6.18.40, and 7.1.5; mainline includes the fix as of 7.2-rc1. Linux distribution vendors (Red Hat, Debian, Ubuntu, SUSE, Arch) typically backport stable kernel fixes to their supported series - consult your distribution's security tracker for the specific package version containing these commits. The upstream fix commits are available at https://git.kernel.org/stable/c/c940d1b96248c3081b664ede5418078bdc7c8c07 and the related stable-branch links in the references. Where immediate kernel upgrade is not feasible, the most targeted compensating control is disabling unprivileged user namespace creation with sysctl -w kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) or sysctl -w user.max_user_namespaces=0 (RHEL/Fedora), which prevents low-privileged processes from obtaining effective CAP_NET_ADMIN to manipulate ipsets; note this will break rootless container runtimes (Podman, Docker rootless) and some Chromium sandbox configurations. Alternatively, if ipset is not used operationally, unloading the ip_set kernel module (modprobe -r ip_set) eliminates the vulnerable code path entirely, with the trade-off of disabling ipset-based firewall rules.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-72434 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy