CVE-2026-72025

Received Received - Intake

s390/monwriter Buffer Reuse Memory Corruption

Publication date: 2026-08-15

Last updated on: 2026-08-18

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: s390/monwriter: Reject buffer reuse with different data length When data buffers are reused, e.g. for interval sample records, the first record determines the data length, and the size of the buffer for user copy. Current monwriter code does not check if the data length was changed for subsequent records, which also would never happen for valid user programs. However, a malicious user could change the data length, resulting in out of bounds user copy to the kernel buffer, and memory corruption. By default, the monwriter misc device is created with root-only permissions, so practical impact is typically low. Fix this by checking for changed data length and rejecting such records.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-18

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72025

EUVD

EUVD-2026-58983

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where the monwriter component fails to validate data buffer reuse properly. When buffers are reused for interval sample records, the first record sets the data length and buffer size. A malicious user could alter the data length for subsequent records, causing out-of-bounds copying from user space to kernel memory. This leads to memory corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's s390/monwriter component and requires kernel-level access to detect. No standard network or system commands can directly identify this issue. Monitoring kernel logs for memory corruption errors or unusual monwriter device activity may provide indirect clues.

Impact Analysis

The impact is typically low because the monwriter misc device is created with root-only permissions by default. However, if exploited, it could allow memory corruption in the kernel, potentially leading to system instability or privilege escalation. Practical exploitation would require local access.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. The issue involves memory corruption due to improper buffer handling in the Linux kernel's monwriter component, which is restricted by default to root-only permissions. No evidence suggests data exposure or privacy violations typical of GDPR/HIPAA non-compliance.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. If patching is not immediately possible, restrict access to the monwriter misc device to prevent unauthorized use. Regularly update the kernel to ensure all security fixes are applied.

Hi! I’m here to help you understand CVE-2026-72025. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70