CVE-2026-72018

Received Received - Intake

Buffer Overflow in Linux Kernel Loopback Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in move_data() The loopback move_data() performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory region bounds natively, the software loopback has no such protection. A peer-supplied out-of-bounds offset or oversized write would result in an OOB write past the allocated kernel buffer. Add an explicit bounds check before the memcpy to reject such requests with -EINVAL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72018

EUVD

EUVD-2026-59117

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel's dibs loopback driver. The move_data() function performs a memory copy without validating if the offset and size exceed the allocated buffer length. This allows an attacker to write beyond the buffer, causing an out-of-bounds write in the kernel.

Detection Guidance

This vulnerability affects the Linux kernel's dibs loopback module. Detection requires checking for kernel versions with the vulnerable code and monitoring for unexpected memory writes. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

An attacker with access to the loopback interface could exploit this to corrupt kernel memory, potentially leading to system crashes, privilege escalation, or unauthorized code execution. This could compromise the confidentiality, integrity, and availability of the system.

Compliance Impact

This vulnerability involves an out-of-bounds write in the Linux kernel's loopback driver, which could lead to memory corruption. Such issues may compromise system integrity and data confidentiality, potentially violating compliance requirements under GDPR (data protection) and HIPAA (health data security) if exploited.

Mitigation Strategies

Apply the latest Linux kernel security patches to address the dibs loopback move_data() vulnerability. Monitor vendor advisories for updates and ensure your kernel version includes the fix for CVE-2026-72018.

Hi! I’m here to help you understand CVE-2026-72018. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70