CVE-2026-72065
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In the Linux kernel, the net: mana driver lacks validation of the packet length reported by the NIC in the RX CQE. The length is passed to skb processing without verification, which can lead to errors.
Risk Assessment
Incorrect packet length can lead to system crashes or potentially remote code execution if an attacker can control data from the NIC.
Recommendation
Apply the Linux kernel patch that adds validation of the packet length before passing it to skb processing.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the packet length reported by the NIC Validate the packet length reported in the RX CQE before passing it to skb processing. The CQE is supplied by the NIC device and should not be blindly trusted.