Improper handling of exceptional conditions in Linux kernel - CVE-2026-72395

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU143037

Improper handling of exceptional conditions in Linux kernel - CVE-2026-72395

Published: August 15, 2026


Vulnerability identifier: #VU143037
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72395
CWE-ID: CWE-755
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local privileged user to bypass hardware protection handling.

The vulnerability exists due to improper exception handling in the pmbus regulator event notification worker when processing combined regulator fault events. A local privileged user can trigger multiple distinct regulator events before the worker runs to bypass hardware protection handling.

The issue occurs because combined event bitmasks are passed unmodified to the regulator core, where strict event handling can leave the fault reason unset.


Affected software

Linux kernel
Ubuntu
linux-gcp-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)

How to mitigate CVE-2026-72395

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-gcp-7.0 (Ubuntu package) - addressed in versions 7.0.0-38.38~24.04.4, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14~24.04.1
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1

External References

Related Security Bulletins