What is the CVSS score of CVE-2026-72480?

CVE-2026-72480 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72480?

CVE-2026-72480 is a HIGH severity kernel memory corruption vulnerability in the Linux kernel's Xilinx hardware driver affecting systems running version 5.17 and later.. A patch is available.

How to fix or mitigate CVE-2026-72480?

Within 24 hours, identify all systems running Linux kernel 5.17 or later with Xilinx-ams IIO ADC drivers and document affected deployments across your infrastructure. Within 7 days, deploy vendor-released patches to all affected stable kernel branches (6.1, 6.6, 6.12, 6.18, and 7.1 series), coordinating with teams managing Xilinx-based systems and scheduling updates during planned maintenance windows. By day 30, complete patch verification across your Xilinx platform inventory and update change management records to confirm remediation.

Linux Kernel CVE-2026-72480

EUVD-2026-59379 HIGH

2026-08-15 Linux

GHSA-c7xc-qxg6-9546

Buffer Overflow Linux Red Hat Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local access with low privilege required to reach the IIO device interface; kernel memory corruption from the OOB dereference yields full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 09:46 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:57 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 05:57 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling

ams_event_to_channel() may return a pointer past the end of dev->channels when no matching scan_index is found. This can lead to invalid memory access in ams_handle_event().

Add a bounds check in ams_event_to_channel() and return NULL when no channel is found. Also guard the caller to safely handle this case.

AnalysisAI

Out-of-bounds memory access in the Linux kernel's xilinx-ams IIO ADC driver allows a local low-privileged user to corrupt kernel memory through malformed event handling in ams_handle_event(). Affected versions span multiple stable kernel branches beginning with the commit that introduced the xilinx-ams driver, with the flaw present from Linux 5.17 onward across the 6.1, 6.6, 6.12, 6.18, and 7.1 stable series. No public exploit exists and EPSS sits at 0.18% (8th percentile), though vendor-released patches are confirmed across six stable branches and the CVSS 7.8 score reflects genuine kernel memory corruption potential on affected Xilinx hardware platforms.

Technical ContextAI

The xilinx-ams driver (drivers/iio/adc/xilinx-ams.c) provides Linux IIO (Industrial I/O) subsystem support for Xilinx/AMD FPGA and SoC platforms that include on-chip Analog Mixed Signal (AMS) components - typically the System Monitor (SYSMON) peripheral present in UltraScale+, Zynq, and Zynq UltraScale+ device families. The function ams_event_to_channel() iterates dev->channels to locate a channel whose scan_index matches the incoming IIO event descriptor, but lacks a terminating bounds check: when no match is found, the function returns a pointer that has advanced past the end of the channels array. ams_handle_event() then dereferences this out-of-bounds pointer, constituting a kernel-space out-of-bounds memory access. The CPE cpe:2.3:a:linux:linux covers the upstream kernel codebase. No CWE is formally assigned by NVD, but the root cause maps squarely to CWE-125 (Out-of-bounds Read) and, depending on how the invalid pointer is subsequently used, potentially CWE-787 (Out-of-bounds Write). The fix adds a NULL-return guard in ams_event_to_channel() and a caller-side NULL check in ams_handle_event().

RemediationAI

The primary remediation is upgrading to a patched stable kernel release: 6.1.178 or later in the 6.1.x series, 6.6.145 or later in the 6.6.x series, 6.12.97 or later in the 6.12.x series, 6.18.40 or later in the 6.18.x series, or 7.1.5 or later in the 7.1.x series. Individual fix commits for cherry-picking against custom kernel builds are available at https://git.kernel.org/stable/c/116d1f8805ae2daadbac89d24da4c0da50b9edae, https://git.kernel.org/stable/c/94d158985b6ea011bdc26186f42d662a156da6cb, https://git.kernel.org/stable/c/1d24f14e049fdd769146dda026496ed23b397ed9, https://git.kernel.org/stable/c/9ac3675bf875792dced45efbf47116719a7c097b, https://git.kernel.org/stable/c/3c374d33f1338dbb5676919c5194caa9c5aa1631, and https://git.kernel.org/stable/c/947eb6f0a274f8b15a0248051a65b069effd5057. For systems that cannot be patched immediately, blacklisting the xilinx_ams kernel module via 'echo blacklist xilinx_ams >> /etc/modprobe.d/xilinx-ams-blacklist.conf && dracut -f' disables the vulnerable driver entirely, though this will render AMS/SYSMON monitoring functionality unavailable on Xilinx hardware - an acceptable trade-off for unpatched environments. Additionally, restricting local user access to the IIO event character device via filesystem ACLs or an AppArmor/SELinux policy targeting /dev/iio:device* reduces the attack surface without disabling the driver.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72480 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72480

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code