Skip to main content

Linux Kernel CVE-2026-72494

| EUVDEUVD-2026-59393 CRITICAL
2026-08-15 Linux GHSA-pw35-43jc-62v7
Information Disclosure Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: Linux
Share

Severity by source

Sources disagree (Low–Critical)
Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
2.5 LOW

Local timing-dependent race in an optional driver so AV:L/AC:H/PR:L; realistic impact is availability (hang/crash) with no confirmed confidentiality or integrity primitive.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.5 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Aug 17, 2026 - 09:53 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.8 (CRITICAL)
CVE Published
Aug 15, 2026 - 05:57 cve.org
CRITICAL 9.8
CVE Published
Aug 15, 2026 - 05:57 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

RDMA/irdma: Replace waitqueue and flag with completion

The driver previously used a waitqueue along with an explicit request_done flag, but without proper barriers around request_done.

An earlier patch by Gui-Dong Han <hanguidong02@gmail.com> attempted to fix this by adding the missing memory barriers. Rather than adding the barriers, this patch replaces the waitqueue+flag with a completion, which is designed for this exact purpose.

AnalysisAI

Race condition in the Linux kernel's RDMA/irdma (Intel Ethernet RDMA) driver arises from a legacy waitqueue-plus-flag synchronization pattern that lacked memory barriers around the request_done flag; maintainers resolved it by switching to a completion primitive. Kernels from 5.14 onward that load the irdma module are affected, but the defect is a local concurrency bug in a specific hardware driver, not the remote unauthenticated code execution its CVSS 9.8 rating implies. No public exploit identified at time of analysis, EPSS is low (0.16%, 6th percentile), and it is not in CISA KEV.

Technical ContextAI

The irdma driver provides RDMA (Remote Direct Memory Access) verbs support for Intel Ethernet controllers (X722/E810 family) in the Linux kernel. The affected code synchronized an asynchronous control-message request/response using a waitqueue combined with a plain request_done boolean, but the flag was accessed without the acquire/release memory barriers needed to guarantee ordering and visibility across CPUs. This is a classic data-race / improper-synchronization defect (CWE-362 class, though CWE is marked N/A in the feed): a waiter could observe a stale flag value or miss a wake-up. The fix replaces the ad-hoc waitqueue+flag with the kernel's completion primitive (struct completion), which encodes the barriers and wait/signal semantics correctly. An earlier proposed patch by Gui-Dong Han tried to bolt on the missing barriers; the accepted fix instead removed the error-prone construct entirely.

RemediationAI

Upstream fix available (commits, not a single tagged release); released patched version not independently confirmed - apply the kernel update containing commits bde37aed0724c0139dea177f3aae8d989b6babb1 and d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd via your distribution's patched kernel package (referenced at https://git.kernel.org/stable/c/bde37aed0724c0139dea177f3aae8d989b6babb1 and https://git.kernel.org/stable/c/d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd), then reboot. Where patching must be deferred and RDMA is not in use, a concrete compensating control is to prevent the vulnerable driver from loading - blacklist the irdma module (e.g. modprobe blacklist) or unbind it - which fully removes the affected code path; the trade-off is loss of RDMA/RoCE functionality on Intel NICs, so this is only viable on hosts that do not rely on RDMA. Restrict local and container/tenant access on RDMA-enabled hosts to limit who can drive the affected code paths until patched.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72494 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy