CyberSecBulletin
CVE-2026-72041NVD status: Received

Linux: Improper Control of a Resource Through its Lifetime

Published Updated By the CyberSecBulletin desk

CVE-2026-72041 is a critical-severity improper control of a resource through its lifetime vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 518dcb84b997dff461800b079e5f2596389f766a, 4ea8c051b4bd7feec7749a980f2f70e1782b84d7, a977f78adce40b39d90d9567e7987bb110102810 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.71% chance of exploitation within 30 days, higher than 54% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to 518dcb84b997dff461800b079e5f2596389f766a or 4ea8c051b4bd7feec7749a980f2f70e1782b84d7 or a977f78adce40b39d90d9567e7987bb110102810 or 54d73f18f8919735f4d04d6f43374f75756c0180, whichever matches your release line, or a later version.
  2. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxe27cca96cd68fa2c6814c90f9a1cfd36bb68c593 up to, but not including, 518dcb84b997dff461800b079e5f2596389f766a; e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 up to, but not including, 4ea8c051b4bd7feec7749a980f2f70e1782b84d7; e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 up to, but not including, a977f78adce40b39d90d9567e7987bb110102810; e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 up to, but not including, 54d73f18f8919735f4d04d6f43374f75756c0180; e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 up to, but not including, 14c0b42c8a2cd9b5361bbff45b52f69c62c6a286; e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 up to, but not including, a66d45e0ce6d73cd79962d422388e61bfaf0cb50; e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 up to, but not including, a338ce41bc933d8f74c39d9b3b6f1d8ca53d9714; e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 up to, but not including, 007800408002d871f5699bdb944f985896730b8f; and 1 more ranges518dcb84b997dff461800b079e5f2596389f766a, 4ea8c051b4bd7feec7749a980f2f70e1782b84d7, a977f78adce40b39d90d9567e7987bb110102810, 54d73f18f8919735f4d04d6f43374f75756c0180, 14c0b42c8a2cd9b5361bbff45b52f69c62c6a286, a66d45e0ce6d73cd79962d422388e61bfaf0cb50

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: espintcp: use sk_msg_free_partial to fix partial send sk_msg_free_partial() ensures consistency of the skmsg at every iteration, without having to manually handle uncharges and offsets. This simplifies the code, and fixes some bugs in skmsg accounting when we don't send the full contents.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Control of a Resource Through its Lifetime

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

More Improper Control of a Resource Through its Lifetime vulnerabilities (CWE-664)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Control of a Resource Through its Lifetime vulnerabilities

Spotted an error? Tell us.