CVE-2026-72041
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: espintcp: use sk_msg_free_partial to fix partial send sk_msg_free_partial() ensures consistency of the skmsg at every iteration, without having to manually handle uncharges and offsets. This simplifies the code, and fixes some bugs in skmsg accounting when we don't send the full contents.
Severity
CRITICAL
CVSS score
9.8
(v3.1)
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-08-15 06:21:13.257000
Last modified
2026-10-19 22:17:23.437000
View original CVE JSON
{
"id": "CVE-2026-72041",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-08-15T06:21:13.257",
"lastModified": "2026-10-19T22:17:23.437",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nespintcp: use sk_msg_free_partial to fix partial send\n\nsk_msg_free_partial() ensures consistency of the skmsg at every\niteration, without having to manually handle uncharges and offsets.\nThis simplifies the code, and fixes some bugs in skmsg accounting when\nwe don't send the full contents."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"net/xfrm/espintcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"lessThan": "518dcb84b997dff461800b079e5f2596389f766a",
"versionType": "git",
"status": "affected"
},
{
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"lessThan": "4ea8c051b4bd7feec7749a980f2f70e1782b84d7",
"versionType": "git",
"status": "affected"
},
{
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"lessThan": "a977f78adce40b39d90d9567e7987bb110102810",
"versionType": "git",
"status": "affected"
},
{
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"lessThan": "54d73f18f8919735f4d04d6f43374f75756c0180",
"versionType": "git",
"status": "affected"
},
{
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"lessThan": "14c0b42c8a2cd9b5361bbff45b52f69c62c6a286",
"versionType": "git",
"status": "affected"
},
{
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"lessThan": "a66d45e0ce6d73cd79962d422388e61bfaf0cb50",
"versionType": "git",
"status": "affected"
},
{
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"lessThan": "a338ce41bc933d8f74c39d9b3b6f1d8ca53d9714",
"versionType": "git",
"status": "affected"
},
{
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"lessThan": "007800408002d871f5699bdb944f985896730b8f",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"net/xfrm/espintcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.6",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.6",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.266",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.217",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.184",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.145",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.97",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.40",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.1.5",
"lessThanOrEqual": "7.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-16T15:50:34.375706Z",
"id": "CVE-2026-72041",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-664"
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/007800408002d871f5699bdb944f985896730b8f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/14c0b42c8a2cd9b5361bbff45b52f69c62c6a286",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4ea8c051b4bd7feec7749a980f2f70e1782b84d7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/518dcb84b997dff461800b079e5f2596389f766a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/54d73f18f8919735f4d04d6f43374f75756c0180",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a338ce41bc933d8f74c39d9b3b6f1d8ca53d9714",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a66d45e0ce6d73cd79962d422388e61bfaf0cb50",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a977f78adce40b39d90d9567e7987bb110102810",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}