CVE-2026-72065: Linux

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the packet length reported by the NIC Validate the packet length reported in the RX CQE before passing it to skb processing. The CQE is supplied by the NIC device and should not be blindly trusted.

Affected products

• Linux Linux: from 5.13, before 5.15.217 (fixed in 5.15.217); from 5.16, before 6.1.184 (fixed in 6.1.184); from 6.2, before 6.6.148 (fixed in 6.6.148); from 6.7, before 6.12.101 (fixed in 6.12.101); from 6.13, before 6.18.42 (fixed in 6.18.42); from 6.19, before 7.1.5 (fixed in 7.1.5)

Published 2026-08-15. Last modified 2026-08-23.