The Linux kernel’s ATM networking code has a flaw that allows an attacker to supply an ATM traffic class value higher than the maximum allowed constant ATM_ANYCLASS during QoS configuration. Although the check_tp() function rejects the value, the erroneous traffic class is still stored in the socket control block. When the proc filesystem enumerates ATM PVCs via /proc/net/atm/pvc, the kernel’s pvc_info() routine indexes an array using this corrupted value, leading to an out‑of‑bounds read. The out‑of‑bounds access exposes arbitrary kernel memory contents in the proc entry, thereby enabling local disclosure of kernel data. This is a classic type of out‑of‑bounds read, as captured by CWE‑125.

The Linux kernel implements ATM networking support, and the vulnerability exists in all kernel versions that do not yet integrate the QoS validation fix for CVE‑2026‑72297. The affected vendor/product is the Linux kernel. No specific kernel version range is listed in the advisory, so any kernel that has not incorporated the patch is vulnerable.

The attacker would need to supply an invalid traffic class in an ATM connection, which likely requires some network access to the target host. The CVE description does not explicitly state the privilege level required to trigger the vulnerability; however, reading /proc/net/atm/pvc is generally restricted to privileged users, so the exploitation would be more valuable to an attacker with elevated privileges. EPSS <1% and CVSS 7.1, and the flaw is not listed in the CISA KEV catalog. The potential to read kernel memory through an out‑of‑bounds read makes the risk non‑negligible until the kernel is updated.