Skip to main content

Linux Kernel CVE-2026-72488

| EUVDEUVD-2026-59387 HIGH
2026-08-15 Linux GHSA-m46v-696m-pmpf
Buffer Overflow Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local kernel subsystem bug requiring low-privilege access to trigger; full C/I/A impact assigned if kernel memory corruption enables privilege escalation, consistent with syzkaller-confirmed OOB condition.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Aug 17, 2026 - 09:51 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
CVE Published
Aug 15, 2026 - 05:57 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 05:57 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

soundwire: fix bug in sdw_add_element_group_count found by syzkaller

The original implementation caused an out-of-bounds memory access in the sdw_add_element_group_count for-loop when i == num.

for (i = 0; i <= num; i++) { if (rate group->rates[i] && lane group->lanes[i]) ...

To fix this error, the function now checks for existing rate/lane entries in the group(a function parameter) using a for-loop before adding them.

No functional changes apart from this fix.

AnalysisAI

Out-of-bounds memory access in the Linux kernel's SoundWire audio subsystem exposes local low-privilege users on affected kernel versions to potential privilege escalation to root. The off-by-one loop error in sdw_add_element_group_count, discovered via Google's syzkaller fuzzer, allows iteration to read beyond valid array bounds when the iterator equals the element count, potentially corrupting adjacent kernel memory. No active exploitation is confirmed (no CISA KEV entry), and an EPSS of 0.21% at the 11th percentile reflects minimal real-world exploitation activity at time of analysis, though the local vector and low privilege requirement mean any authenticated user on a SoundWire-equipped system is theoretically within scope.

Technical ContextAI

SoundWire is a MIPI Alliance audio interconnect protocol implemented in the Linux kernel's sound subsystem, commonly found on Intel-based laptops and mobile platforms with modern audio codecs. The vulnerability is in sdw_add_element_group_count, which manages rate and lane group memberships for SoundWire bus elements. The defective loop condition 'for (i = 0; i <= num; i++)' reads group->rates[i] and group->lanes[i] at index num - one past the last valid index (0 through num-1) - constituting a classic off-by-one out-of-bounds read. Although no CWE is formally assigned, the 'Buffer Overflow' tag and code description align with CWE-125 (Out-of-bounds Read). The affected CPE is cpe:2.3:a:linux:linux:*, covering the kernel from the introducing commit 9026118f20e28f202dab34f219bbb831ffb8c4dc across multiple stable branches. Because the flaw occurs in kernel space, even an out-of-bounds read can yield controlled memory corruption depending on adjacent heap layout, creating a potential local privilege escalation pathway.

RemediationAI

The primary remediation is to apply the upstream kernel patches, which are available as three stable-branch fix commits: https://git.kernel.org/stable/c/a454f61747c97e2eadaa7a35ffc1f4b1645c6a53, https://git.kernel.org/stable/c/e483a406a23a92d5202e8d324f206e127eef48ff, and https://git.kernel.org/stable/c/f772ff5a0e6758fd412803c09e03ba3bca5f5878. Upgrade to kernel version 7.1.5, 6.18.40, or 7.2-rc1 (or later in the respective series) as appropriate for your distribution. For systems where immediate kernel upgrade is not feasible, blacklisting the SoundWire module by adding 'blacklist soundwire_bus' to /etc/modprobe.d/ prevents the vulnerable code path from loading entirely; the trade-off is that SoundWire audio devices will stop functioning. Additionally, restricting untrusted local user accounts on multi-user hosts reduces the practical attack surface until patching is complete. Most Linux distributions will ship backported patches via their standard package managers (apt, dnf, zypper), which is the recommended path for most operators.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72488 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy