CVE-2026-72298
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In the Linux kernel, the qrtr_endpoint_post() function has a 32-bit integer overflow in the ALIGN(size, 4) calculation, which can lead to out-of-bounds write and kernel oops on 32-bit platforms.
Risk Assessment
An attacker could send a specially crafted packet to cause a system crash (oops) or potentially gain unauthorized memory access.
Recommendation
Install the kernel patch that rejects sizes that cannot fit in the buffer before the ALIGN.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() qrtr_endpoint_post() validates an incoming packet with if (!size || len != ALIGN(size, 4) + hdrlen) goto err; where size comes from the wire. On 32-bit, size_t is 32 bits and ALIGN(size, 4) wraps to 0 for size >= 0xfffffffd, so the check passes and skb_put_data(skb, data + hdrlen, size) writes past the hdrlen-sized skb and oopses the kernel. 64-bit is unaffected. This is the 32-bit residual of ad9d24c9429e2 ("net: qrtr: fix OOB Read in qrtr_endpoint_post"), which fixed only the 64-bit case. Reject any size that cannot fit the buffer before the ALIGN.