8.8

CVE-2026-72157: linux

CVSS: 8.8v3.1HighReceived
AliasesUBUNTU-CVE-2026-72157DEBIAN-CVE-2026-72157
Published 15-08-2026Last modified 16-10-2026
Open JSON

Vulnerability summary

CVE-2026-72157 is a high (CVSS 8.8) vulnerability in linux. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.7% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.34%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 19 · Related 19
SUSE-SU-2026:24181-1SUSE-SU-2026:24182-1SUSE-SU-2026:4640-1SUSE-SU-2026:4660-1SUSE-SU-2026:4665-1SUSE-SU-2026:4666-1

Timeline

  1. 15-08-2026
    PublishedVulnerability first disclosed.
  2. 16-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Fix frags[] overflow by bounding frame_count tbnet_poll() assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment. skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, hdr_size, frame_size, TBNET_RX_PAGE_SIZE - hdr_size); A packet of frame_count frames therefore ends up with frame_count - 1 fragments. tbnet_check_frame() only bounds the peer supplied frame_count to TBNET_RING_SIZE / 4 (64), which is far above MAX_SKB_FRAGS (17 by default). A peer that sends a packet of 19 or more small frames pushes nr_frags past MAX_SKB_FRAGS, so skb_add_rx_frag() writes past skb_shinfo()->frags[] and corrupts memory after the shared info. Tighten the start of packet bound to MAX_SKB_FRAGS + 1 so a packet can never produce more fragments than frags[] can hold. This matches the recent skb frags overflow fixes in other receive paths, for example f0813bcd2d9d ("net: wwan: t7xx: fix potential skb->frags overflow in RX path") and 600dc40554dc ("net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()").

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.34%

Chance of exploitation in the next 30 days

Percentile

27%

Versus all other CVEs

30-day change

0.00 pp

From 0.34% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.34%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu168 products
  • linuxAll versions (No fix recorded) | < 6.8.0-147.147 | < 7.0.0-38.38
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 6.8.0-1067.70 | < 7.0.0-1014.14
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linux< 6.1.187-1 | < 6.12.100-1 | < 7.1.5-1
Linux1 product
  • linux≥ e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e, < f96b3b35c622d565eff2438993e028d280163f5c | ≥ e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e, < 6262f51e09d8dc8b07599a9e4f03bd3989d13fff | ≥ e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e, < 569ba39b2d12995a29dc158e5b4de6e449278f30 | ≥ e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e, < 2b3b4e5ff5a58ad32817824b0310e63908b12052 | ≥ e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e, < e27beb4536cbf1d59e2d8c2840e87d972aba906f | ≥ e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e, < e5824d5b841d99a2bcdd4e2c256643293bbc22c1 | ≥ e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e, < fe6b606fbf0c3beb94ccf17fcf31d8c2138264e3 | ≥ e69b6c02b4c3b8d03be7136f90dd9551ad5a5a5e, < 55d9895f89970501fe126d1026b586b04a224c27 | 4.15

3 vendors · 170 products

References

21 links
Show all 21 references