CVE-2026-72297net: atm: reject out-of-range traffic classes in QoS validation
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: atm: reject out-of-range traffic classes in QoS validation Reject ATM traffic classes above ATM_ANYCLASS in check_tp(). SO_ATMQOS stores the supplied QoS after check_qos() succeeds, so accepting larger values leaves invalid traffic_class values in vcc->qos. That bad state later reaches pvc_info(), which indexes class_name[] with vcc->qos.{rx,tp}.traffic_class. Values above ATM_ANYCLASS cause an out-of-bounds read when /proc/net/atm/pvc is read. Tighten the existing QoS validation so invalid traffic_class values are rejected at the point where user supplied QoS is accepted.
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 builds before 1a6dda72455b399ce9c1a12695471dc4d5c61add; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 2b3e241729e87afed13ac0f666472d5d6ca42e87; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 367acd288bc6255e247cb1a1efbf5c6567cab423; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 513f820b3f0cf4462e17d84c39ed3948d061a6ea; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 15444b57fdc6fc3f3e22a87f791ae5be81e6ecf5; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before e62adb157c2eaad9ad4867ec6cd9af5b9a51b1c7; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 806b7b6edc8446e8b94b706807a7090a14d47b5c; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before cdf19f380e46192e7084be559638aab1f6ed86a2 | CNA record |
References
- https://git.kernel.org/stable/c/1a6dda72455b399ce9c1a12695471dc4d5c61add
- https://git.kernel.org/stable/c/2b3e241729e87afed13ac0f666472d5d6ca42e87
- https://git.kernel.org/stable/c/367acd288bc6255e247cb1a1efbf5c6567cab423
- https://git.kernel.org/stable/c/513f820b3f0cf4462e17d84c39ed3948d061a6ea
- https://git.kernel.org/stable/c/15444b57fdc6fc3f3e22a87f791ae5be81e6ecf5
- https://git.kernel.org/stable/c/e62adb157c2eaad9ad4867ec6cd9af5b9a51b1c7
- https://git.kernel.org/stable/c/806b7b6edc8446e8b94b706807a7090a14d47b5c
- https://git.kernel.org/stable/c/cdf19f380e46192e7084be559638aab1f6ed86a2
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.