CyberSecBulletin
CVE-2026-72003NVD status: Received

Linux: Integer Underflow (Wrap or Wraparound)

Published Updated By the CyberSecBulletin desk

CVE-2026-72003 is a high-severity integer underflow (wrap or wraparound) vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions 55b26abb1fa1ec406b3ad11b43c49c7624257565, 185bb156c427d0f865d344a6d0eaa02c6d05cc57, 240c8d2c717b3f8153e7e877b22a82518d78dbdc as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.35% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 55b26abb1fa1ec406b3ad11b43c49c7624257565 or 185bb156c427d0f865d344a6d0eaa02c6d05cc57 or 240c8d2c717b3f8153e7e877b22a82518d78dbdc, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux66f909308a7c05082919ff214a0bbe2a76aa0283 up to, but not including, 55b26abb1fa1ec406b3ad11b43c49c7624257565; 66f909308a7c05082919ff214a0bbe2a76aa0283 up to, but not including, 185bb156c427d0f865d344a6d0eaa02c6d05cc57; 66f909308a7c05082919ff214a0bbe2a76aa0283 up to, but not including, 240c8d2c717b3f8153e7e877b22a82518d78dbdc; 6.1655b26abb1fa1ec406b3ad11b43c49c7624257565, 185bb156c427d0f865d344a6d0eaa02c6d05cc57, 240c8d2c717b3f8153e7e877b22a82518d78dbdc

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmf_notify_auth_frame_rx() takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: u32 mgmt_frame_len = e->datalen - sizeof(struct brcmf_rx_mgmt_data); ... memcpy(&mgmt_frame->u, frame, mgmt_frame_len - offsetof(struct ieee80211_mgmt, u)); The only length check is e->datalen >= sizeof(*rxframe), so mgmt_frame_len can be anything from 0 up. offsetof(struct ieee80211_mgmt, u) is 24. When mgmt_frame_len is below that, the subtraction wraps as an unsigned value to a huge length. The memcpy then runs far past the kzalloc'd buffer. A malicious or malfunctioning AP can make the frame short during the external SAE auth exchange, so this is a remotely triggered heap overflow. Reject frames shorter than the management header offset before the copy.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Integer Underflow (Wrap or Wraparound)

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

More Integer Underflow (Wrap or Wraparound) vulnerabilities (CWE-191)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Integer Underflow (Wrap or Wraparound) vulnerabilities

Spotted an error? Tell us.