What is the CVSS score of EUVD-2026-59196?

EUVD-2026-59196 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-59196?

CVE-2026-72297 affects the Linux kernel's ATM networking subsystem and could allow local users to disclose kernel memory or trigger system crashes.. A patch is available.

How to fix or mitigate EUVD-2026-59196?

Within 24 hours, inventory your Linux systems to confirm whether any run ATM networking services (check for net/atm kernel subsystem); most modern deployments lack ATM entirely. Within 7 days, if ATM is confirmed on any systems, contact your Linux vendor (Ubuntu, RHEL, Debian, etc.) for patch availability and schedule testing in non-production environments. Within 30 days, deploy the vendor patch available per vendor advisory to all ATM-enabled systems; organizations without active ATM deployments can incorporate this fix into standard security patching windows.

Linux Kernel EUVD-2026-59196

| CVE-2026-72297 HIGH

2026-08-15 Linux

GHSA-2234-wg35-953c

Buffer Overflow Linux Red Hat Suse

7.1

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

7.1 HIGH

Local socket access with low privileges required; OOB read yields kernel memory disclosure and crash potential but no write primitive or scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 08:15 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.1 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:55 cve.org

HIGH 7.1

CVE Published

Aug 15, 2026 - 05:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: atm: reject out-of-range traffic classes in QoS validation

Reject ATM traffic classes above ATM_ANYCLASS in check_tp(). SO_ATMQOS stores the supplied QoS after check_qos() succeeds, so accepting larger values leaves invalid traffic_class values in vcc->qos.

That bad state later reaches pvc_info(), which indexes class_name[] with vcc->qos.{rx,tp}.traffic_class. Values above ATM_ANYCLASS cause an out-of-bounds read when /proc/net/atm/pvc is read.

Tighten the existing QoS validation so invalid traffic_class values are rejected at the point where user supplied QoS is accepted.

AnalysisAI

Out-of-bounds read in the Linux kernel ATM networking subsystem (net/atm) allows local low-privileged users to disclose kernel memory or crash the system by supplying an out-of-range traffic_class value via the SO_ATMQOS socket option. The flaw persists because check_tp() fails to reject traffic class values above ATM_ANYCLASS, leaving the invalid value in vcc->qos where it is later used as an unguarded array index in pvc_info() when /proc/net/atm/pvc is read. EPSS sits at 0.22% (13th percentile) with no CISA KEV listing and no public exploit identified, making real-world exploitation risk considerably lower than the CVSS 7.1 score implies, particularly given that ATM networking is a legacy subsystem absent from most modern deployments.

Technical ContextAI

The vulnerability resides in the ATM (Asynchronous Transfer Mode) networking stack of the Linux kernel, specifically in the QoS validation path for virtual circuit connections (VCCs). The root cause is a missing upper-bound check in check_tp() - effectively CWE-125 (Out-of-Bounds Read) - which is called as part of check_qos() when a user sets the SO_ATMQOS socket option on an ATM socket. Because check_tp() does not reject traffic_class values greater than ATM_ANYCLASS, malformed values pass validation and are written into vcc->qos.rx.traffic_class and vcc->qos.tp.traffic_class. These tainted values are subsequently consumed by pvc_info() when the kernel renders /proc/net/atm/pvc, where they are used as direct integer indices into the statically-sized class_name[] array without bounds verification. The affected CPE scope spans cpe:2.3:a:linux:linux:* from version 2.6.12 onward across all stable branches until the respective fix commits.

RemediationAI

Update the Linux kernel to a patched stable release: 5.10.261+, 5.15.212+, 6.1.178+, 6.6.145+, 6.12.97+, 6.18.40+, or 7.1.5+. Distribution maintainers for affected LTS branches should be consulted for packaged updates. Fix commits are available directly at kernel.org stable (see references above) for operators applying patches out-of-band. If immediate kernel update is not possible, disable the ATM subsystem entirely by blocking module load with install atm /bin/false in /etc/modprobe.d/ and removing any loaded ATM modules via rmmod atm - note this eliminates all ATM networking functionality, which is an acceptable trade-off on systems not using ATM hardware. Alternatively, restricting unprivileged creation of AF_ATMPVC sockets via seccomp filters or LSM policy (AppArmor/SELinux socket rules) will prevent the initial setsockopt vector; however, this is more complex to implement correctly and does not remove the vulnerable code path entirely.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

EUVD-2026-59196 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-59196

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code