Linux Linux Kernel Vulnerability Rated 8.8 CVSS

Last refreshed2026-10-15

Status: UPDATED | Advisory ID: CVE-2026-72423

Key Details

CVE	CVE-2026-72423
CVSS Score / Version	8.8 (High) / CVSS v3.1
Updated	2026-10-15
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel
Exploitation prediction (EPSS)	0.17% probability of exploitation in the next 30 days (5% percentile) -- FIRST.org's EPSS model.

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

bpf: Guard conntrack opts error writes

The conntrack lookup and allocation kfuncs take an opts pointer

together with an opts__sz argument. The verifier checks only the memory

range described by opts__sz, but the wrappers unconditionally write

opts->error whenever the internal lookup or allocation helper returns an

error.

For an invalid size smaller than the end of opts->error, that write can

land outside the verifier-checked range. Keep returning NULL for invalid

arguments, but only report the error through opts->error when the

supplied size includes the field.

This preserves error reporting for the supported 12-byte and 16-byte

layouts, and for other invalid sizes that still include opts->error. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-72423
CVE	https://www.cve.org/CVERecord?id=CVE-2026-72423

Source

Reference

NVD

CVE