Integer overflow in Linux kernel - CVE-2026-72298
Published: August 16, 2026
Vulnerability identifier: #VU143141
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72298
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an integer overflow leading to out-of-bounds write in qrtr_endpoint_post() when processing a crafted incoming qrtr packet. A remote attacker can send a specially crafted packet to cause a denial of service.
Only 32-bit systems are affected; 64-bit systems are unaffected.
Affected software
Linux kernel
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
kernel-rt (Red Hat package)
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
kernel-rt (Red Hat package)
How to mitigate CVE-2026-72298
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
kernel-rt (Red Hat package) - update to 4.18.0-553.164.1.rt7.505.el8_10
kernel-rt (Red Hat package) - update to 4.18.0-553.164.1.rt7.505.el8_10
External References
- https://git.kernel.org/stable/c/20054869770c7df060c5ecee3e8bbf9029c47191
- https://git.kernel.org/stable/c/22100a8f73d4ae4f17697dae93d4e2e1d283a6ec
- https://git.kernel.org/stable/c/242408b5b763c01288adf3113cbce84378a76e1a
- https://git.kernel.org/stable/c/3665e644ea081c4624a1637023b0de3b29f4ae04
- https://git.kernel.org/stable/c/689b7267f8632b4661879dc323e26ebb60978afb
- https://git.kernel.org/stable/c/7f72c285f6d3bf63968a0344beee8ab1b370198b
- https://git.kernel.org/stable/c/b609f7f46916c6b05585ca82455077198a23770f
- https://git.kernel.org/stable/c/d0597074e99731fdad5593e4f6d056a3866f2cab