CVE-2026-72065CWE-20

CVE-2026-72065

Critical · published August 15, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
53.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: mana: Validate the packet length reported by the NIC

Validate the packet length reported in the RX CQE before passing it

to skb processing. The CQE is supplied by the NIC device and should

not be blindly trusted.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00728 · 53.7th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-08-15T10:21Z
References (7)
https://git.kernel.org/stable/c/282c5214ca4eb3799158c76782646e86d2945d1b · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2e276b14b6d378372bf0152df89286cbe7632fb0 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2e2a83b4998af4384e677d3b2ac08565274279bf · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6080189291d958604dcefe513a13900835ac982f · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6d13eaa13341a8f80aaf86f78591e1b1d393711d · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a631f82f89c76084ad5b2b9c043d3b391ffa56d8 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d2568e64d01f480200063fadd67d6938f676c66f · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 15 AUG 05:52Z
    net: mana: Validate the packet length reported by the NIC
    cvelistv5