CVE-2026-72298 Linux CVE debrief

Who should care

Users and administrators of 32-bit Linux kernel systems, particularly those using the net: qrtr module, should be aware of this vulnerability. Linux distributions and vendors supporting 32-bit architectures are also advised to apply the necessary patches.

Technical summary

The CVE-2026-72298 vulnerability is caused by an integer overflow in the qrtr_endpoint_post() function of the Linux kernel's net: qrtr module. On 32-bit systems, the size_t type is 32 bits, which can lead to an ALIGN(size, 4) wrap to 0 for size >= 0xfffffffd. This causes the validation check to pass, allowing skb_put_data(skb, data + hdrlen, size) to write past the hdrlen-sized skb, resulting in a kernel oops. The 64-bit systems are unaffected. This issue is a residual of a previous fix ad9d24c9429e2 (net: qrtr: fix OOB Read in qrtr_endpoint_post) that only addressed the 64-bit case. Users of 32-bit Linux kernel systems should prioritize patching. Inventory Linux kernel systems, especially 32-bit installations, to identify potential exposure. Monitor for unusual activity in the net: qrtr module that may indicate exploitation attempts. Apply the patch from the Linux kernel stable repository to fix the vulnerability. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Review compensating controls for exposed systems while remediation is scheduled and verified. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Review the Linux kernel stable repository for the patch. Consider compensating controls for exposed systems. Monitor for unusual activity. Track exceptions and retest remediated assets. Review relevant logs for exposed assets. Confirm affected deployments exist. Review official advisories. Plan updates through change control. Review compensating controls. Monitor activity. Track exceptions. Review logs. Confirm deployments. Review advisories. Plan updates. Review controls. Monitor. Track. Review.

Defensive priority

This vulnerability affects 32-bit systems using the Linux kernel, particularly in the net: qrtr module. The vulnerability allows for an out-of-bounds write, potentially leading to a denial of service or code execution. Users of 32-bit Linux kernel systems should prioritize patching.

Recommended defensive actions

• Apply the patch from the Linux kernel stable repository to fix the vulnerability
• Inventory Linux kernel systems, especially 32-bit installations, to identify potential exposure
• Monitor for unusual activity in the net: qrtr module that may indicate exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE-2026-72298 vulnerability is caused by an integer overflow in the qrtr_endpoint_post() function of the Linux kernel's net: qrtr module. On 32-bit systems, the size_t type is 32 bits, which can lead to an ALIGN(size, 4) wrap to 0 for size >= 0xfffffffd. This causes the validation check to pass, allowing skb_put_data(skb, data + hdrlen, size) to write past the hdrlen-sized skb, resulting in a kernel oops. The 64-bit systems are unaffected. This issue is a residual of a previous fix ad9d24c9429e2 (net: qrtr: fix OOB Read in qrtr_endpoint_post) that only addressed the 64-bit case.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.