Skip to main content

Linux Kernel EUVDEUVD-2026-38702

| CVE-2026-52932 HIGH
2026-06-24 Linux GHSA-jvgr-44j9-74mp
Information Disclosure Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
3.7 LOW

Reachable over network via IPsec but only with IPComp enabled and repeated acomp errors (AC:H), unauthenticated (PR:N), and per-error leak yields gradual partial DoS (A:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:26 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.5 (HIGH)
Patch available
Jun 24, 2026 - 09:16 EUVD
CVE Published
Jun 24, 2026 - 07:14 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 07:14 cve.org
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xfrm: ipcomp: Free destination pages on acomp errors

Move the out_free_req label up by a couple of lines so that the allocated dst SG list gets freed on error as well as success.

AnalysisAI

Memory leak in the Linux kernel's xfrm IPComp (IP Payload Compression) code allows resource exhaustion because the destination scatter-gather page list is not freed when an asynchronous compression (acomp) operation fails. Affecting Linux 6.15 through the fixed stable releases, the flaw lets repeated compression errors progressively consume kernel memory, with CVSS scoring only availability impact (A:H). There is no public exploit identified at time of analysis and EPSS is low at 0.15%.

Technical ContextAI

The bug lives in the xfrm (IPsec transformation) subsystem's IPComp implementation, which compresses IPsec payloads using the kernel crypto acomp (asynchronous compression) API. When processing, the code allocates a destination scatter-gather (SG) page list; on the success path this is freed at the out_free_req label, but on the acomp error path the function returned before reaching that cleanup, leaking the allocated destination pages. The upstream fix simply moves the out_free_req label up a few lines so the dst SG list is freed on both error and success. The CWE is listed as N/A, but the root cause is a classic missing-release-on-error-path memory leak (CWE-401 / CWE-772 class). CPE data identifies the affected product generically as cpe:2.3:a:linux:linux, i.e. the mainline Linux kernel.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.18.35, 7.0.12, or 7.1 (or later) - which contain the corrected out_free_req cleanup, per the stable commits at https://git.kernel.org/stable/c/dc6dcba80d72a27ab61831ad3d253316e0c9b9d5, https://git.kernel.org/stable/c/b30aa173c3809f6af4c83a86099be1be19aa48eb, and https://git.kernel.org/stable/c/7dbac7680eb629b3b4dc7e98c34f943b8814c0c8. If immediate kernel patching is not possible, the most direct compensating control is to avoid IPComp: configure IPsec policies without IP Payload Compression so the vulnerable xfrm ipcomp path is never exercised, at the trade-off of losing payload compression bandwidth savings. Restricting which peers can establish IPsec/IPComp tunnels and monitoring kernel SLAB/memory growth for unexplained leaks are reasonable interim measures. Reference the NVD/EUVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-52932 and https://vuldb.com/vuln/373196.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-38702 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy