Out-of-bounds read in Linux kernel - CVE-2026-72285
Published: August 16, 2026
Vulnerability identifier: #VU143157
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72285
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause an out-of-bounds read.
The vulnerability exists due to an out-of-bounds read in tdx_td_init() and CPUID parsing when processing a KVM_TDX_INIT_VM request with a concurrently modified cpuid entry count. A local user can modify cpuid.nent between the initial read and the subsequent copy to cause an out-of-bounds read.
The issue arises from a mismatch between the cpuid entry count used to size the copied initialization data and the count later used as the array bound during CPUID entry lookup.
Affected software
Linux kernel
Ubuntu
linux-gcp-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
Ubuntu
linux-gcp-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
How to mitigate CVE-2026-72285
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux-gcp-7.0 (Ubuntu package) - addressed in versions 7.0.0-38.38~24.04.4, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14~24.04.1
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1
linux-gcp-7.0 (Ubuntu package) - addressed in versions 7.0.0-38.38~24.04.4, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14~24.04.1
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1