SB2026081627 - Out-of-bounds read in Linux kernel net

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081627

SB2026081627 - Out-of-bounds read in Linux kernel net

Published: August 16, 2026

Security Bulletin ID SB2026081627
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Out-of-bounds read (CVE-ID: CVE-2026-72351)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in gue_remcsum() and gue_gro_remcsum() when processing malformed GUE packets with the REMCSUM private flag set but without the required REMCSUM metadata fields. A remote attacker can send a specially crafted packet to disclose sensitive information.

The issue occurs because option validation accepts packets that contain only the private flags field even when additional REMCSUM start and offset fields are expected.


Remediation

Install update from vendor's website.

References