CVE-2026-72060

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72060", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.903Z", "datePublished": "2026-08-15T05:52:15.099Z", "dateUpdated": "2026-08-17T05:07:27.219Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:07:27.219Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: ti: icssg: guard PA stat lookups\n\nicssg_ndo_get_stats64() unconditionally calls emac_get_stat_by_name()\nwith FW PA stat names regardless of whether the PA stats block is\npresent on the hardware. emac_get_stat_by_name() already guards the\nPA stats lookup with `if (emac->prueth->pa_stats)`; when that pointer\nis NULL the lookup falls through to netdev_err() and returns -EINVAL.\nBecause ndo_get_stats64 is polled regularly by the networking stack\nthis produces thousands of log entries of the form:\n\n icssg-prueth icssg1-eth end0: Invalid stats FW_RX_ERROR\n\nA secondary consequence is that the int(-EINVAL) return value is\nimplicitly widened to a near-ULLONG_MAX unsigned value when accumulated\ninto the __u64 fields of rtnl_link_stats64, silently corrupting the\nrx_errors, rx_dropped and tx_dropped counters reported by `ip -s link`.\n\nEvery other PA-aware code path in the driver is already guarded with\nthe same `if (emac->prueth->pa_stats)` check. Apply the same guard\nhere."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/ti/icssg/icssg_common.c"], "versions": [{"version": "0d15a26b247d25cd012134bf8825128fedb15cc9", "lessThan": "121c5f31c3fb70d4a23e8a084f5cb8b3ec63be8d", "status": "affected", "versionType": "git"}, {"version": "0d15a26b247d25cd012134bf8825128fedb15cc9", "lessThan": "b3763f7e22ecaa7ad79bf44bf41816d488edbcf8", "status": "affected", "versionType": "git"}, {"version": "0d15a26b247d25cd012134bf8825128fedb15cc9", "lessThan": "27b9daba50609335db6ca81e4cccf50ded21ec76", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/ti/icssg/icssg_common.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/121c5f31c3fb70d4a23e8a084f5cb8b3ec63be8d"}, {"url": "https://git.kernel.org/stable/c/b3763f7e22ecaa7ad79bf44bf41816d488edbcf8"}, {"url": "https://git.kernel.org/stable/c/27b9daba50609335db6ca81e4cccf50ded21ec76"}], "title": "net: ethernet: ti: icssg: guard PA stat lookups", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/ti/icssg/icssg_common.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "121c5f31c3fb70d4a23e8a084f5cb8b3ec63be8d", "status": "affected", "version": "0d15a26b247d25cd012134bf8825128fedb15cc9", "versionType": "git"}, {"lessThan": "b3763f7e22ecaa7ad79bf44bf41816d488edbcf8", "status": "affected", "version": "0d15a26b247d25cd012134bf8825128fedb15cc9", "versionType": "git"}, {"lessThan": "27b9daba50609335db6ca81e4cccf50ded21ec76", "status": "affected", "version": "0d15a26b247d25cd012134bf8825128fedb15cc9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/ti/icssg/icssg_common.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: ti: icssg: guard PA stat lookups\n\nicssg_ndo_get_stats64() unconditionally calls emac_get_stat_by_name()\nwith FW PA stat names regardless of whether the PA stats block is\npresent on the hardware. emac_get_stat_by_name() already guards the\nPA stats lookup with `if (emac->prueth->pa_stats)`; when that pointer\nis NULL the lookup falls through to netdev_err() and returns -EINVAL.\nBecause ndo_get_stats64 is polled regularly by the networking stack\nthis produces thousands of log entries of the form:\n\n icssg-prueth icssg1-eth end0: Invalid stats FW_RX_ERROR\n\nA secondary consequence is that the int(-EINVAL) return value is\nimplicitly widened to a near-ULLONG_MAX unsigned value when accumulated\ninto the __u64 fields of rtnl_link_stats64, silently corrupting the\nrx_errors, rx_dropped and tx_dropped counters reported by `ip -s link`.\n\nEvery other PA-aware code path in the driver is already guarded with\nthe same `if (emac->prueth->pa_stats)` check. Apply the same guard\nhere."}], "id": "CVE-2026-72060", "lastModified": "2026-08-17T06:18:04.373", "metrics": {}, "published": "2026-08-15T06:21:15.530", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/121c5f31c3fb70d4a23e8a084f5cb8b3ec63be8d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/27b9daba50609335db6ca81e4cccf50ded21ec76"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b3763f7e22ecaa7ad79bf44bf41816d488edbcf8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: ethernet: ti: icssg: guard PA stat lookups", "id": "2516587", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516587"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["A flaw was found in the Linux kernel's Texas Instruments (TI) Industrial Communication Subsystem Gigabit (ICSSG) ethernet driver. This vulnerability occurs because the driver attempts to read hardware performance statistics even when they are unavailable. This leads to the silent corruption of network interface counters, such as those for received errors or dropped packets, which can provide inaccurate information about network performance."], "name": "CVE-2026-72060", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72060\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72060\nhttps://lore.kernel.org/linux-cve-announce/2026081517-CVE-2026-72060-9fde@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0d15a26b247d25cd012134bf8825128fedb15cc9,121c5f31c3fb70d4a23e8a084f5cb8b3ec63be8d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0d15a26b247d25cd012134bf8825128fedb15cc9,b3763f7e22ecaa7ad79bf44bf41816d488edbcf8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0d15a26b247d25cd012134bf8825128fedb15cc9,27b9daba50609335db6ca81e4cccf50ded21ec76)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T08:45:05.631604+00:00", "updated": "2026-08-18T06:00:04.163994+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}