CVE-2026-72351

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-72351

Key Details

CVE	CVE-2026-72351
CVSS Score / Version	9.8 (Critical) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

gue: validate REMCSUM private option length

GUE private flags can indicate that remote checksum offload metadata is

present. The private flags field itself is accounted for by

guehdr_flags_len(), but guehdr_priv_flags_len() currently returns 0 even

when GUE_PFLAG_REMCSUM is set.

This lets a packet with only the private flags field pass

validate_gue_flags(), after which gue_remcsum() and gue_gro_remcsum()

read the missing REMCSUM start/offset fields from the following bytes.

Account for GUE_PLEN_REMCSUM when GUE_PFLAG_REMCSUM is present so that

malformed packets are rejected during option validation. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-72351
CVE	https://www.cve.org/CVERecord?id=CVE-2026-72351

Source

Reference

NVD

CVE