CVE-2026-72423

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72423", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.928Z", "datePublished": "2026-08-15T05:56:41.711Z", "dateUpdated": "2026-10-30T12:29:22.084Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:29:22.084Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Guard conntrack opts error writes\n\nThe conntrack lookup and allocation kfuncs take an opts pointer\ntogether with an opts__sz argument. The verifier checks only the memory\nrange described by opts__sz, but the wrappers unconditionally write\nopts->error whenever the internal lookup or allocation helper returns an\nerror.\n\nFor an invalid size smaller than the end of opts->error, that write can\nland outside the verifier-checked range. Keep returning NULL for invalid\narguments, but only report the error through opts->error when the\nsupplied size includes the field.\n\nThis preserves error reporting for the supported 12-byte and 16-byte\nlayouts, and for other invalid sizes that still include opts->error."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires loading and attaching a BPF XDP or TC program that calls the conntrack kfuncs via the bpf() syscall; per kernel CNA guidance BPF/netfilter paths are Local even when programs later run on network packets.\nAC:L - An attacker reliably triggers the bug by calling bpf_xdp_ct_lookup/alloc or bpf_skb_ct_lookup/alloc with opts__sz smaller than the error field (e.g. 4); the helper returns EINVAL and the wrapper performs the out-of-bounds write with no races or attacker-uncontrollable conditions.\nPR:L - Loading BPF_PROG_TYPE_XDP or BPF_PROG_TYPE_SCHED_CLS programs requires CAP_NET_ADMIN, which unprivileged users can obtain inside user/network namespaces (unshare -Urn) on typical Linux deployments without init-namespace root.\nUI:N - No victim interaction is required; the attacker loads their own BPF program and invokes the kfunc with a small opts__sz to trigger the out-of-bounds write on demand.\nS:C - Corrupting kernel memory via a verifier-bypassing BPF stack write from a user/network namespace can cross the namespace/container trust boundary to compromise the host kernel, exceeding the attacker's original security scope.\nC:H - The bug is a controlled 4-byte out-of-bounds write past the verifier-approved opts buffer on the BPF stack, a memory-corruption primitive that can be leveraged for arbitrary kernel memory disclosure.\nI:H - Writing opts->error outside the verifier-checked range corrupts adjacent BPF stack slots with attacker-influenced errno values, enabling heap/stack grooming and control-flow hijacking toward arbitrary kernel code execution.\nA:H - Corrupting BPF stack memory outside verifier bounds can cause immediate kernel oops/panic or be used in a repeatable crash/DoS loop when the attached XDP/TC program runs on incoming traffic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nf_conntrack_bpf.c"], "versions": [{"version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6", "lessThan": "6fd973def4d6cb89aaf7e9b6bc26cac977f6da13", "status": "affected", "versionType": "git"}, {"version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6", "lessThan": "669bc3b345712112d3f033a1953f5a10b15e7c65", "status": "affected", "versionType": "git"}, {"version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6", "lessThan": "63d95c6bbd6fc0e411404188306a1fea456300b0", "status": "affected", "versionType": "git"}, {"version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6", "lessThan": "453f4f1e90de55b6bc297936031b68bef93f2e28", "status": "affected", "versionType": "git"}, {"version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6", "lessThan": "dd74c80203842a21b2ebb9f70d1260d9aa20fa05", "status": "affected", "versionType": "git"}, {"version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6", "lessThan": "6f6183a39533d727deaa5061cadae6dd9e6744d0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nf_conntrack_bpf.c"], "versions": [{"version": "5.18", "status": "affected"}, {"version": "0", "lessThan": "5.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6fd973def4d6cb89aaf7e9b6bc26cac977f6da13"}, {"url": "https://git.kernel.org/stable/c/669bc3b345712112d3f033a1953f5a10b15e7c65"}, {"url": "https://git.kernel.org/stable/c/63d95c6bbd6fc0e411404188306a1fea456300b0"}, {"url": "https://git.kernel.org/stable/c/453f4f1e90de55b6bc297936031b68bef93f2e28"}, {"url": "https://git.kernel.org/stable/c/dd74c80203842a21b2ebb9f70d1260d9aa20fa05"}, {"url": "https://git.kernel.org/stable/c/6f6183a39533d727deaa5061cadae6dd9e6744d0"}], "title": "bpf: Guard conntrack opts error writes", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72423", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:49:41.501757Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:55:23.252Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72423", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:49:41.501757Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:49:42.245Z"}}], "cna": {"title": "bpf: Guard conntrack opts error writes", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires loading and attaching a BPF XDP or TC program that calls the conntrack kfuncs via the bpf() syscall; per kernel CNA guidance BPF/netfilter paths are Local even when programs later run on network packets.\nAC:L - An attacker reliably triggers the bug by calling bpf_xdp_ct_lookup/alloc or bpf_skb_ct_lookup/alloc with opts__sz smaller than the error field (e.g. 4); the helper returns EINVAL and the wrapper performs the out-of-bounds write with no races or attacker-uncontrollable conditions.\nPR:L - Loading BPF_PROG_TYPE_XDP or BPF_PROG_TYPE_SCHED_CLS programs requires CAP_NET_ADMIN, which unprivileged users can obtain inside user/network namespaces (unshare -Urn) on typical Linux deployments without init-namespace root.\nUI:N - No victim interaction is required; the attacker loads their own BPF program and invokes the kfunc with a small opts__sz to trigger the out-of-bounds write on demand.\nS:C - Corrupting kernel memory via a verifier-bypassing BPF stack write from a user/network namespace can cross the namespace/container trust boundary to compromise the host kernel, exceeding the attacker's original security scope.\nC:H - The bug is a controlled 4-byte out-of-bounds write past the verifier-approved opts buffer on the BPF stack, a memory-corruption primitive that can be leveraged for arbitrary kernel memory disclosure.\nI:H - Writing opts->error outside the verifier-checked range corrupts adjacent BPF stack slots with attacker-influenced errno values, enabling heap/stack grooming and control-flow hijacking toward arbitrary kernel code execution.\nA:H - Corrupting BPF stack memory outside verifier bounds can cause immediate kernel oops/panic or be used in a repeatable crash/DoS loop when the attached XDP/TC program runs on incoming traffic."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6", "lessThan": "669bc3b345712112d3f033a1953f5a10b15e7c65", "versionType": "git"}, {"status": "affected", "version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6", "lessThan": "63d95c6bbd6fc0e411404188306a1fea456300b0", "versionType": "git"}, {"status": "affected", "version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6", "lessThan": "453f4f1e90de55b6bc297936031b68bef93f2e28", "versionType": "git"}, {"status": "affected", "version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6", "lessThan": "dd74c80203842a21b2ebb9f70d1260d9aa20fa05", "versionType": "git"}, {"status": "affected", "version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6", "lessThan": "6f6183a39533d727deaa5061cadae6dd9e6744d0", "versionType": "git"}], "programFiles": ["net/netfilter/nf_conntrack_bpf.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"status": "unaffected", "version": "0", "lessThan": "5.18", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.114", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.57", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/netfilter/nf_conntrack_bpf.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/669bc3b345712112d3f033a1953f5a10b15e7c65"}, {"url": "https://git.kernel.org/stable/c/63d95c6bbd6fc0e411404188306a1fea456300b0"}, {"url": "https://git.kernel.org/stable/c/453f4f1e90de55b6bc297936031b68bef93f2e28"}, {"url": "https://git.kernel.org/stable/c/dd74c80203842a21b2ebb9f70d1260d9aa20fa05"}, {"url": "https://git.kernel.org/stable/c/6f6183a39533d727deaa5061cadae6dd9e6744d0"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Guard conntrack opts error writes\n\nThe conntrack lookup and allocation kfuncs take an opts pointer\ntogether with an opts__sz argument. The verifier checks only the memory\nrange described by opts__sz, but the wrappers unconditionally write\nopts->error whenever the internal lookup or allocation helper returns an\nerror.\n\nFor an invalid size smaller than the end of opts->error, that write can\nland outside the verifier-checked range. Keep returning NULL for invalid\narguments, but only report the error through opts->error when the\nsupplied size includes the field.\n\nThis preserves error reporting for the supported 12-byte and 16-byte\nlayouts, and for other invalid sizes that still include opts->error."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.114", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.57", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "5.18"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:44:53.905Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72423", "state": "PUBLISHED", "dateUpdated": "2026-10-21T12:44:53.905Z", "dateReserved": "2026-08-09T03:40:39.928Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:56:41.711Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/nf_conntrack_bpf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6fd973def4d6cb89aaf7e9b6bc26cac977f6da13", "status": "affected", "version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6", "versionType": "git"}, {"lessThan": "669bc3b345712112d3f033a1953f5a10b15e7c65", "status": "affected", "version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6", "versionType": "git"}, {"lessThan": "63d95c6bbd6fc0e411404188306a1fea456300b0", "status": "affected", "version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6", "versionType": "git"}, {"lessThan": "453f4f1e90de55b6bc297936031b68bef93f2e28", "status": "affected", "version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6", "versionType": "git"}, {"lessThan": "dd74c80203842a21b2ebb9f70d1260d9aa20fa05", "status": "affected", "version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6", "versionType": "git"}, {"lessThan": "6f6183a39533d727deaa5061cadae6dd9e6744d0", "status": "affected", "version": "b4c2b9593a1c4c3a718370e34af28e817fd5e5c6", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netfilter/nf_conntrack_bpf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"lessThan": "5.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Guard conntrack opts error writes\n\nThe conntrack lookup and allocation kfuncs take an opts pointer\ntogether with an opts__sz argument. The verifier checks only the memory\nrange described by opts__sz, but the wrappers unconditionally write\nopts->error whenever the internal lookup or allocation helper returns an\nerror.\n\nFor an invalid size smaller than the end of opts->error, that write can\nland outside the verifier-checked range. Keep returning NULL for invalid\narguments, but only report the error through opts->error when the\nsupplied size includes the field.\n\nThis preserves error reporting for the supported 12-byte and 16-byte\nlayouts, and for other invalid sizes that still include opts->error."}], "id": "CVE-2026-72423", "lastModified": "2026-10-30T13:19:52.040", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72423", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:49:41.501757Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:22:16.117", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/453f4f1e90de55b6bc297936031b68bef93f2e28"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/63d95c6bbd6fc0e411404188306a1fea456300b0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/669bc3b345712112d3f033a1953f5a10b15e7c65"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6f6183a39533d727deaa5061cadae6dd9e6744d0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6fd973def4d6cb89aaf7e9b6bc26cac977f6da13"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dd74c80203842a21b2ebb9f70d1260d9aa20fa05"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf: Guard conntrack opts error writes", "id": "2516305", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516305"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in the Linux kernel. The BPF (Berkeley Packet Filter) subsystem's conntrack (connection tracking) functionality contains an out-of-bounds write vulnerability. This occurs because the system does not properly validate the size of an options structure when reporting errors in conntrack lookup and allocation kernel functions (kfuncs). An attacker could potentially exploit this by providing an invalid size, leading to memory corruption."], "name": "CVE-2026-72423", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72423\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72423\nhttps://lore.kernel.org/linux-cve-announce/2026081526-CVE-2026-72423-9fac@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b4c2b9593a1c4c3a718370e34af28e817fd5e5c6,dd74c80203842a21b2ebb9f70d1260d9aa20fa05)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b4c2b9593a1c4c3a718370e34af28e817fd5e5c6,6f6183a39533d727deaa5061cadae6dd9e6744d0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T12:00:05.303264+00:00", "updated": "2026-08-18T14:45:03.711757+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}