Skip to main content

Linux Kernel CVE-2026-72487

| EUVDEUVD-2026-59386 HIGH
2026-08-15 Linux GHSA-8mf8-73cp-cjmq
Denial Of Service Linux Red Hat Suse
7.7
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.7 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Local vector confirmed; PR:L assessed rather than PR:N because enabling PCI ROM sysfs typically requires elevated privileges on default Linux distributions.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:48 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.7 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:57 cve.org
HIGH 7.7
CVE Published
Aug 15, 2026 - 05:57 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

PCI: Check ROM header and data structure addr before accessing

We meet a crash when running stress-ng on x86_64 machine:

BUG: unable to handle page fault for address: ffa0000007f40000 RIP: 0010:pci_get_rom_size+0x52/0x220 Call Trace: <TASK> pci_map_rom+0x80/0x130 pci_read_rom+0x4b/0xe0 kernfs_file_read_iter+0x96/0x180 vfs_read+0x1b1/0x300

Our analysis reveals that the ROM space's start address is 0xffa0000007f30000, and size is 0x10000. Because of broken ROM space, before calling readl(pds), the pds's value is 0xffa0000007f3ffff, which is already pointed to the ROM space end, invoking readl() would read 4 bytes therefore cause an out-of-bounds access and trigger a crash. Fix this by adding image header and data structure checking.

We also found another crash on arm64 machine:

Unable to handle kernel paging request at virtual address ffff8000dd1393ff Mem abort info: ESR = 0x0000000096000021 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x21: alignment fault

The call trace is the same with x86_64, but the crash reason is that the data structure addr is not aligned with 4, and arm64 machine report "alignment fault". Fix this by adding alignment checking.

[bhelgaas: shorten function names, wrap comments]

AnalysisAI

Out-of-bounds memory access in the Linux kernel PCI ROM parsing subsystem crashes or leaks kernel memory on both x86_64 and arm64 architectures. The pci_get_rom_size() function fails to validate ROM image header and PCI data structure pointer bounds before dereferencing them, allowing a crafted or malformed PCI ROM space to induce a kernel page fault (x86_64) or alignment fault (arm64). Any local actor able to trigger a PCI ROM sysfs read against a device with a broken ROM region can crash the kernel (DoS) or expose kernel memory contents (information disclosure). EPSS is 0.21% with no KEV listing, indicating no confirmed broad exploitation, though the local crash path is straightforwardly reproducible as demonstrated by stress-ng.

Technical ContextAI

The vulnerable function pci_get_rom_size() is called via the PCI sysfs ROM read path: vfs_read → kernfs_file_read_iter → pci_read_rom → pci_map_rom → pci_get_rom_size. When iterating PCI ROM images, the code reads a PCI data structure header pointer (pds) from the ROM image without validating that (a) the resulting address falls within the mapped ROM region bounds and (b) the address is naturally aligned for a 32-bit readl() call. On x86_64 with a 64 KB broken ROM region starting at 0xffa0000007f30000, the pds pointer resolves to 0xffa0000007f3ffff - one byte before the end of the region - causing a 4-byte readl() to cross the region boundary and fault. On arm64, the data structure address is not 4-byte-aligned, triggering a hardware alignment fault (ESR=0x96000021, FSC=0x21). The fix adds explicit bounds and alignment checks before dereferencing ROM image structure pointers. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. No formal CWE mapping was assigned by NVD, but the root cause class is CWE-125 (Out-of-bounds Read) combined with CWE-1284 (Improper Validation of Specified Quantity in Input) - specifically, absence of address range and alignment validation on externally-sourced pointer values.

RemediationAI

The primary fix is upgrading to a patched kernel release: 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1, depending on the stable branch in use. Upstream stable patches are available at git.kernel.org (see references). If kernel upgrade is not immediately feasible, restrict unprivileged access to PCI sysfs ROM files by ensuring that /sys/bus/pci/devices/*/rom is not world-readable and that enabling PCI ROM (echo 1 > .../rom) requires CAP_SYS_ADMIN - this is the default on most distributions but should be verified. Disabling or blacklisting pci_read_rom via kernel parameter or module configuration is not straightforward, but restricting physical or logical access to systems with broken/non-standard PCI ROM hardware reduces exposure. On containerized environments, ensure PCI device passthrough is limited to trusted workloads, as this is the most likely local exploitation path for multi-tenant deployments. Note that restricting sysfs access may break legitimate PCI ROM inspection tools.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72487 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy