CVE-2026-72041 - Vulnerability Details

- espintcp: use sk_msg_free_partial to fix partial send

Description

In the Linux kernel, the following vulnerability has been resolved:

espintcp: use sk_msg_free_partial to fix partial send

sk_msg_free_partial() ensures consistency of the skmsg at every
iteration, without having to manually handle uncharges and offsets.
This simplifies the code, and fixes some bugs in skmsg accounting when
we don't send the full contents.

Published: 2026-08-15

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability involved the espintcp subsystem of the Linux kernel, where partial TCP send operations were incorrectly accounted for in skmsg objects. This could lead to inconsistent skmsg state and potential resource leaks or incorrect metrics.

Affected Systems

The affected product is the Linux kernel. No explicit version range is provided, but the commit that adds sk_msg_free_partial appears in all recent kernel releases that include the espintcp patch. All distributions that ship the Linux kernel are potentially impacted until the patch is incorporated.

Risk and Exploitability

Based on the description, the flaw pertains to incorrect accounting of TCP send buffers when partial sends are used, which could result in inconsistent skmsg state and possible resource leaks or inaccurate metrics. The CVSS score of 9.8 signals a high severity. The EPSS score of <1% indicates a very low probability of exploitation in the wild. No exploits are documented, and the vulnerability appears to be limited to kernel resource accounting logic.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e27cca96cd68fa2c6814c90f9a1cfd36bb68c593`	affected	< 518dcb84b997dff461800b079e5f2596389f766a
`e27cca96cd68fa2c6814c90f9a1cfd36bb68c593`	affected	< 4ea8c051b4bd7feec7749a980f2f70e1782b84d7
`e27cca96cd68fa2c6814c90f9a1cfd36bb68c593`	affected	< a977f78adce40b39d90d9567e7987bb110102810
`e27cca96cd68fa2c6814c90f9a1cfd36bb68c593`	affected	< 54d73f18f8919735f4d04d6f43374f75756c0180
`e27cca96cd68fa2c6814c90f9a1cfd36bb68c593`	affected	< 14c0b42c8a2cd9b5361bbff45b52f69c62c6a286
`e27cca96cd68fa2c6814c90f9a1cfd36bb68c593`	affected	< a66d45e0ce6d73cd79962d422388e61bfaf0cb50
`e27cca96cd68fa2c6814c90f9a1cfd36bb68c593`	affected	< a338ce41bc933d8f74c39d9b3b6f1d8ca53d9714
`e27cca96cd68fa2c6814c90f9a1cfd36bb68c593`	affected	< 007800408002d871f5699bdb944f985896730b8f

Linux

affected

Version	Status	Constraints
`5.6`	affected	—
`0`	unaffected	< 5.6
`5.10.266`	unaffected	≤ 5.10.*
`5.15.217`	unaffected	≤ 5.15.*
`6.1.184`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[e27cca96cd68fa2c6814c90f9a1cfd36bb68c593,54d73f18f8919735f4d04d6f43374f75756c0180)`	affected	code_commit	—
`[e27cca96cd68fa2c6814c90f9a1cfd36bb68c593,14c0b42c8a2cd9b5361bbff45b52f69c62c6a286)`	affected	code_commit	—
`[e27cca96cd68fa2c6814c90f9a1cfd36bb68c593,a66d45e0ce6d73cd79962d422388e61bfaf0cb50)`	affected	code_commit	—
`[e27cca96cd68fa2c6814c90f9a1cfd36bb68c593,a338ce41bc933d8f74c39d9b3b6f1d8ca53d9714)`	affected	code_commit	—
`[e27cca96cd68fa2c6814c90f9a1cfd36bb68c593,007800408002d871f5699bdb944f985896730b8f)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.6`	affected	generic	—
`[0,5.6)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to the latest Linux kernel version that incorporates the espintcp sk_msg_free_partial patch, addressing the resource accounting weaknesses (CWE-664, CWE-805).
If an upgrade cannot be performed immediately, avoid using partial TCP send calls in application code, mitigating potential inconsistencies covered by CWE-664 by ensuring full buffer usage.
Audit custom or third‑party kernel modules that interact with TCP send buffers to verify compatibility with the new sk_msg_free_partial behavior and to address any residual CWE-805 concerns.

Generated by OpenCVE AI on October 22, 2026 at 23:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Ubuntu USN	USN-8781-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8816-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8816-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8816-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8816-4	Linux kernel (GKE) vulnerabilities
Ubuntu USN	USN-8888-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8888-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8917-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8918-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00714.

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/007800408002d871f5699bdb944f985896730b8f
https://git.kernel.org/stable/c/14c0b42c8a2cd9b5361bbff45b52f69c62c6a286
https://git.kernel.org/stable/c/4ea8c051b4bd7feec7749a980f2f70e1782b84d7
https://git.kernel.org/stable/c/518dcb84b997dff461800b079e5f2596389f766a
https://git.kernel.org/stable/c/54d73f18f8919735f4d04d6f43374f75756c0180
https://git.kernel.org/stable/c/a338ce41bc933d8f74c39d9b3b6f1d8ca53d9714
https://git.kernel.org/stable/c/a66d45e0ce6d73cd79962d422388e61bfaf0cb50
https://git.kernel.org/stable/c/a977f78adce40b39d90d9567e7987bb110102810
https://lore.kernel.org/linux-cve-announce/2026081513-CVE-2026-72041-6717@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72041
https://www.cve.org/CVERecord?id=CVE-2026-72041

History

Tue, 20 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-250 CWE-759

Mon, 19 Oct 2026 22:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-664

Fri, 16 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sun, 23 Aug 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/4ea8c051b4bd7feec7749a980f2f70e1782b84d7 https://git.kernel.org/stable/c/518dcb84b997dff461800b079e5f2596389f766a https://git.kernel.org/stable/c/a977f78adce40b39d90d9567e7987bb110102810

Tue, 18 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-805
References		https://lore.kernel.org/linux-cve-announce/2026081513-CVE-2026-72041-6717@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72041 https://www.cve.org/CVERecord?id=CVE-2026-72041
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-250 CWE-759

Mon, 17 Aug 2026 08:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-665

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 22:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: espintcp: use sk_msg_free_partial to fix partial send sk_msg_free_partial() ensures consistency of the skmsg at every iteration, without having to manually handle uncharges and offsets. This simplifies the code, and fixes some bugs in skmsg accounting when we don't send the full contents.
Title		espintcp: use sk_msg_free_partial to fix partial send
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/007800408002d871f5699bdb944f985896730b8f https://git.kernel.org/stable/c/14c0b42c8a2cd9b5361bbff45b52f69c62c6a286 https://git.kernel.org/stable/c/54d73f18f8919735f4d04d6f43374f75756c0180 https://git.kernel.org/stable/c/a338ce41bc933d8f74c39d9b3b6f1d8ca53d9714 https://git.kernel.org/stable/c/a66d45e0ce6d73cd79962d422388e61bfaf0cb50

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:52:00.721Z

Updated: 2026-10-19T21:19:24.315Z

Reserved: 2026-08-09T03:40:39.901Z

Link: CVE-2026-72041

Vulnrichment

Updated: 2026-10-16T15:50:35.235Z

NVD

Status : Received

Published: 2026-08-15T06:21:13.257

Modified: 2026-10-19T22:17:23.437

Link: CVE-2026-72041

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72041 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T00:00:16Z

Weaknesses

CWE-664
Improper Control of a Resource Through its Lifetime
CWE-805
Buffer Access with Incorrect Length Value

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object