Skip to main content

Linux Kernel EUVDEUVD-2026-59349

| CVE-2026-72450 HIGH
2026-08-15 Linux GHSA-j58f-wqfc-2rv4
Buffer Overflow Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local access required with low privileges (user namespace or CAP_NET_ADMIN); kernel memory corruption yields full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:30 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:56 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 05:56 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xfrm: validate selector family and prefixlen during match

syzbot reported a shift-out-of-bounds in xfrm_selector_match() due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched against IPv4 flow (when XFRM_STATE_AF_UNSPEC is set).

Fix this by:

  • Rejecting mismatched families in xfrm_selector_match.
  • Returning false in addr4_match if prefixlen > 32.
  • Returning false in addr_match if prefixlen > 128 (prevents overflow).

AnalysisAI

Shift-out-of-bounds in the Linux kernel's XFRM subsystem allows a local low-privileged attacker to corrupt kernel memory by crafting an AF_UNSPEC selector with an oversized prefixlen (e.g., 128) and triggering a match against an IPv4 flow when XFRM_STATE_AF_UNSPEC is set. Affected systems span multiple long-term stable kernel branches from 4.19 through 6.12.x, with patched versions available across all impacted series. No public exploit has been identified and the vulnerability is not in CISA KEV; EPSS at 0.22% confirms minimal observed exploitation activity.

Technical ContextAI

The XFRM subsystem is the Linux kernel's policy-based transform and IPsec engine used for VPN tunneling, traffic encryption, and routing. The vulnerable function xfrm_selector_match() evaluates address-family and prefix-length fields of network selectors against live traffic flows. When a selector is constructed with AF_UNSPEC (address-family unspecified) and a prefixlen of 128 - the maximum for IPv6 - and is then evaluated against an IPv4 flow while the XFRM_STATE_AF_UNSPEC flag is active (permitting cross-family matching), the bit-shift operations inside addr4_match and addr_match exceed the valid 32-bit range for IPv4, producing an undefined shift-out-of-bounds in kernel space. The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers all affected branches. No CWE is formally assigned, but the root cause aligns with CWE-125 (Out-of-bounds Read) and CWE-682 (Incorrect Calculation) due to missing prefixlen bounds validation before the shift operation.

RemediationAI

Upgrade to a patched stable kernel version: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 7.1.5, or 7.2-rc1. Stable-tree fix commits are published at https://git.kernel.org/stable/c/87a5bbccc7ff4edb3f42fea387124237d2ba91ee, https://git.kernel.org/stable/c/bd7f202cf77556cff59f68dc30e4cdf40cb6e33b, and related references. If immediate kernel upgrade is not possible, restrict XFRM policy management to CAP_NET_ADMIN-privileged processes only and audit running XFRM policies to remove any AF_UNSPEC selectors - this directly eliminates the triggering condition. Note that removing AF_UNSPEC selectors may break dual-stack IPsec tunnels that rely on family-agnostic policy matching, so validate against existing VPN configurations before applying this workaround.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-59349 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy