Out-of-bounds read in Linux kernel - CVE-2026-72029

 

Out-of-bounds read in Linux kernel - CVE-2026-72029

Published: August 16, 2026


Vulnerability identifier: #VU143564
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72029
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds read and improper validation of device-supplied offsets and lengths in mux_dl_adb_decode() in the iosm MUX downlink decoder when processing modem-supplied aggregated datagram tables in a received skb. A local attacker can provide crafted offset and length values to trigger out-of-bounds reads and an infinite loop to disclose sensitive information and cause a denial of service.

The issue can be triggered by a modem that supplies malformed table and datagram metadata after the iosm net device is up, and the loop runs in softirq while cloning the skb on each pass.


Affected software

Linux kernel

How to mitigate CVE-2026-72029

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3

External References

Related Security Bulletins