CVE-2026-72297

Received Received - Intake

ATM QoS Validation Flaw in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: atm: reject out-of-range traffic classes in QoS validation Reject ATM traffic classes above ATM_ANYCLASS in check_tp(). SO_ATMQOS stores the supplied QoS after check_qos() succeeds, so accepting larger values leaves invalid traffic_class values in vcc->qos. That bad state later reaches pvc_info(), which indexes class_name[] with vcc->qos.{rx,tp}.traffic_class. Values above ATM_ANYCLASS cause an out-of-bounds read when /proc/net/atm/pvc is read. Tighten the existing QoS validation so invalid traffic_class values are rejected at the point where user supplied QoS is accepted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72297

EUVD

EUVD-2026-59196

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's ATM (Asynchronous Transfer Mode) networking subsystem. It involves improper validation of traffic class values in QoS (Quality of Service) settings. When a user supplies a QoS value with a traffic class exceeding ATM_ANYCLASS, the kernel accepts it and stores it in the vcc->qos structure. Later, when reading /proc/net/atm/pvc, the kernel indexes an array using this invalid traffic class value, causing an out-of-bounds read.

Detection Guidance

This vulnerability can be detected by checking for out-of-bounds traffic class values in ATM QoS configurations. Monitor /proc/net/atm/pvc for invalid traffic_class values above ATM_ANYCLASS. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow an attacker with local access to trigger an out-of-bounds read in the kernel. This might lead to kernel memory corruption, crashes, or potential information leaks. However, exploitation requires local access and the ability to set QoS values, limiting the attack surface.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue involving out-of-bounds reads in ATM traffic class validation, which could lead to information exposure but does not inherently violate data protection or privacy regulations.

Mitigation Strategies

Apply the Linux kernel patch that tightens QoS validation to reject invalid traffic_class values. Update to a kernel version containing the fix. Monitor system logs for signs of exploitation via /proc/net/atm/pvc reads.

Hi! I’m here to help you understand CVE-2026-72297. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70