CVE-2026-72380 Linux CVE debrief

Who should care

Users of the Linux kernel, particularly those with confidential and disaggregated deployments, should be aware of this vulnerability and apply the fix. This vulnerability is related to the Linux kernel and has been resolved. A malicious or buggy backend can cause an out-of-bounds write. Consider applying the fix and monitoring for backend behavior. Operators of Linux kernel deployments, platform administrators, and security teams should review the vulnerability and apply the fix as necessary. Vulnerability management and security teams should also review the vulnerability and assess the impact on their deployments. The vulnerability affects Linux kernel deployments, particularly those with confidential and disaggregated deployments. Security teams should review the vulnerability and assess the impact on their deployments. Operators of Linux kernel deployments should review the vulnerability and apply the fix as necessary. Platform administrators should also review the vulnerability and assess the impact on their deployments. Vulnerability management teams should review the vulnerability and assess the impact on their deployments. Security teams should review the vulnerability and assess the impact on their deployments. The vulnerability affects Linux kernel deployments, particularly those with confidential and disaggregated deployments. Security teams should review the vulnerability and assess the impact on their deployments. Operators of Linux kernel deployments should review the vulnerability and apply the fix as necessary. Platform administrators should also review the vulnerability and assess the impact on their deployments. Vulnerability management teams should review the vulnerability and assess the impact on their deployments. Security teams should review the vulnerability and assess the impact on their deployments. The vulnerability affects Linux kernel deployments, particularly those with confidential and disaggregated deployments. Security teams should review the vulnerability and assess the impact on their deployments. Operators of Linux kernel deployments should review the vulnerability and apply the fix as necessary. Platform administrators should

Technical summary

The Linux kernel vulnerability, CVE-2026-72380, allows for an out-of-bounds write due to a lack of range checking on req_id in pvcalls_front_event_handler(). Declare req_id as u32 to cover both ends. A backend that sends an out-of-range req_id has violated the wire protocol. The pvcalls frontend currently trusts its backend, so this is not a classic-Xen security issue, but it matters for hardening PV frontends against malicious backends (confidential and disaggregated deployments).

Defensive priority

This vulnerability is related to the Linux kernel and has been resolved. A malicious or buggy backend can cause an out-of-bounds write. Consider applying the fix and monitoring for backend behavior.

Recommended defensive actions

• Apply the provided fix to bound backend response req_id before indexing rsp[]
• Monitor backend behavior for out-of-range req_id
• Consider compensating controls for malicious or buggy backend
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The Linux kernel vulnerability allows for an out-of-bounds write due to a lack of range checking on req_id. Declare req_id as u32 to cover both ends. A backend that sends an out-of-range req_id has violated the wire protocol. Consider compensating controls and monitoring.

Official resources