Skip to main content

Linux Kernel CVE-2026-72497

| EUVDEUVD-2026-59396 HIGH
2026-08-15 Linux GHSA-66r3-8x6w-f98f
Information Disclosure Linux Red Hat Suse
High
Disputed · 8.8 Vendor: Linux
Share

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

Local access with low privileges sufficient via RDMA verbs; scope change applies as kernel memory corruption crosses privilege boundary.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Aug 17, 2026 - 09:55 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.8 (HIGH)
CVE Published
Aug 15, 2026 - 05:57 cve.org
HIGH 8.8
CVE Published
Aug 15, 2026 - 05:57 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: Add a max slot check for SQ

The variable WQE mode must be validated against the maximum slots supported by HW. The max supported value is 64K. Adding a max and min check and fail if user supplied value is more than the max supported and zero.

AnalysisAI

Kernel memory corruption in the Linux RDMA bnxt_re (Broadcom NetXtreme) driver allows a local low-privileged user to trigger undefined hardware behavior by submitting WQE (Work Queue Entry) mode values that exceed the 64K hardware maximum or are zero, with no bounds validation applied. The CVSS vector (AV:L/AC:L/PR:L/S:C/C:H/I:H/A:H, score 8.8) reflects that a local unprivileged process interacting with RDMA verbs can cause a scoped kernel-level impact, including potential memory corruption or system crash. No public exploit has been identified at time of analysis, and EPSS at 0.15% (5th percentile) indicates very low observed exploitation probability, but the scope change to kernel space makes this a meaningful risk in environments deploying Broadcom RDMA adapters.

Technical ContextAI

The affected subsystem is RDMA/bnxt_re, the kernel driver for Broadcom NetXtreme Ethernet RDMA adapters (CPE: cpe:2.3:a:linux:linux:*). RDMA (Remote Direct Memory Access) exposes kernel-managed hardware queue structures directly to user-space applications via the Linux verbs API. The WQE (Work Queue Entry) mode parameter, which governs how entries are written to the Send Queue (SQ), must be validated against hardware-supported slot counts - a maximum of 64K slots. The root cause is a missing bounds check: the driver accepted user-supplied WQE mode values without verifying they fall within the range (1, 65535). CWE is not assigned, but this maps naturally to CWE-20 (Improper Input Validation) or CWE-1284 (Improper Validation of Specified Quantity in Input). On affected kernels from commit d8ea645d6984c84a87032063a0941f15a323831f, submitting an out-of-range value can corrupt hardware command state or kernel memory structures managed by the driver, potentially crossing the privilege boundary into kernel context (explaining the S:C scope change in the CVSS vector).

RemediationAI

Apply the upstream kernel patches available at https://git.kernel.org/stable/c/dc95931b7e1326dacae547874bf38c092e5960d8 (stable branch fix) and https://git.kernel.org/stable/c/a59d815cbe667929b693b5fa6716a074e6a31c5b (mainline fix). Distributions should update to Linux 7.1.5 or 7.2-rc1 or later, or backport the specific commit to their supported kernel version. As a compensating control where patching is not immediately possible, unloading the bnxt_re kernel module ('modprobe -r bnxt_re') prevents the vulnerable code path from being accessible, though this disables all RDMA functionality on affected Broadcom adapters - a significant trade-off in RDMA-dependent workloads. Restricting access to RDMA verb interfaces via udev rules or user/group permissions ('rdma' group membership, /dev/infiniband* permissions) limits exploitation surface to authorized RDMA users only, without fully eliminating risk.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72497 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy