CVE-2026-72014 (GCVE-0-2026-72014)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:51 – Updated: 2026-08-17 05:39
VLAI
Title
drbd: reject data replies with an out-of-range payload size
Summary
In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the signed int data_size, and two peer-controlled inputs can make it negative. With a negotiated data-integrity-alg the digest length is subtracted first, so a reply whose payload is smaller than the digest underflows data_size. With no integrity algorithm (the default) data_size is assigned from the unsigned h95/h100 wire length and drbdd() never bounds it for a payload-carrying command, so a length above INT_MAX casts it negative; this path needs no non-default feature. The bio receive loop then computes expect = min_t(int, data_size, bv_len), which is negative, and drbd_recv_all_warn(mapped, expect) receives with a size_t of SIZE_MAX into the first mapped page. The sibling receive path read_in_block() is not affected: it uses an unsigned size and rejects it against DRBD_MAX_BIO_SIZE before receiving. Reject a data reply whose size is negative after the optional digest subtraction, covering both triggers. Impact: a malicious or man-in-the-middle DRBD peer copies attacker-chosen bytes past a bio page in the receiver, corrupting kernel memory. A node that reads from its peer (a diskless node, or read-balancing to the peer) is exposed in the default configuration; data-integrity-alg is not required.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b411b3637fa71fce9cf2acf0639009500f5892fe , < bca33f5442c3094511719d9db792ce3165d87e76 (git)
Affected: b411b3637fa71fce9cf2acf0639009500f5892fe , < 741a682535deffe9ab7e5c89caf83571efbc9dd9 (git)
Affected: b411b3637fa71fce9cf2acf0639009500f5892fe , < f14e87d7b166490bceb9603b39310e51595d05b9 (git)
Affected: b411b3637fa71fce9cf2acf0639009500f5892fe , < f16866c62656865854106b79bcf6e4ca97a51a92 (git)
Affected: b411b3637fa71fce9cf2acf0639009500f5892fe , < 5f59a8142000f0b8f75c432209ead73c424a745d (git)
Affected: b411b3637fa71fce9cf2acf0639009500f5892fe , < 38cc4867540ae8beedfe41a1a1a6ed37052c77d6 (git)
Affected: b411b3637fa71fce9cf2acf0639009500f5892fe , < 648d4317326e6aa3f8c05cbf0fd14cc2eba6ca99 (git)
Affected: b411b3637fa71fce9cf2acf0639009500f5892fe , < bd910a7660d280595ef94cb6d193951d855d330f (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.33
Unaffected: 0 , < 2.6.33 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/drbd/drbd_receiver.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bca33f5442c3094511719d9db792ce3165d87e76",
              "status": "affected",
              "version": "b411b3637fa71fce9cf2acf0639009500f5892fe",
              "versionType": "git"
            },
            {
              "lessThan": "741a682535deffe9ab7e5c89caf83571efbc9dd9",
              "status": "affected",
              "version": "b411b3637fa71fce9cf2acf0639009500f5892fe",
              "versionType": "git"
            },
            {
              "lessThan": "f14e87d7b166490bceb9603b39310e51595d05b9",
              "status": "affected",
              "version": "b411b3637fa71fce9cf2acf0639009500f5892fe",
              "versionType": "git"
            },
            {
              "lessThan": "f16866c62656865854106b79bcf6e4ca97a51a92",
              "status": "affected",
              "version": "b411b3637fa71fce9cf2acf0639009500f5892fe",
              "versionType": "git"
            },
            {
              "lessThan": "5f59a8142000f0b8f75c432209ead73c424a745d",
              "status": "affected",
              "version": "b411b3637fa71fce9cf2acf0639009500f5892fe",
              "versionType": "git"
            },
            {
              "lessThan": "38cc4867540ae8beedfe41a1a1a6ed37052c77d6",
              "status": "affected",
              "version": "b411b3637fa71fce9cf2acf0639009500f5892fe",
              "versionType": "git"
            },
            {
              "lessThan": "648d4317326e6aa3f8c05cbf0fd14cc2eba6ca99",
              "status": "affected",
              "version": "b411b3637fa71fce9cf2acf0639009500f5892fe",
              "versionType": "git"
            },
            {
              "lessThan": "bd910a7660d280595ef94cb6d193951d855d330f",
              "status": "affected",
              "version": "b411b3637fa71fce9cf2acf0639009500f5892fe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/block/drbd/drbd_receiver.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.33"
            },
            {
              "lessThan": "2.6.33",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrbd: reject data replies with an out-of-range payload size\n\nrecv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an\noutstanding read request. The peer-supplied payload length reaches it as\nthe signed int data_size, and two peer-controlled inputs can make it\nnegative. With a negotiated data-integrity-alg the digest length is\nsubtracted first, so a reply whose payload is smaller than the digest\nunderflows data_size. With no integrity algorithm (the default) data_size\nis assigned from the unsigned h95/h100 wire length and drbdd() never\nbounds it for a payload-carrying command, so a length above INT_MAX casts\nit negative; this path needs no non-default feature. The bio receive loop\nthen computes expect = min_t(int, data_size, bv_len), which is negative,\nand drbd_recv_all_warn(mapped, expect) receives with a size_t of SIZE_MAX\ninto the first mapped page.\n\nThe sibling receive path read_in_block() is not affected: it uses an\nunsigned size and rejects it against DRBD_MAX_BIO_SIZE before receiving.\nReject a data reply whose size is negative after the optional digest\nsubtraction, covering both triggers.\n\nImpact: a malicious or man-in-the-middle DRBD peer copies attacker-chosen\nbytes past a bio page in the receiver, corrupting kernel memory. A node\nthat reads from its peer (a diskless node, or read-balancing to the peer)\nis exposed in the default configuration; data-integrity-alg is not\nrequired."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Exploitation is delivered over the DRBD replication TCP protocol when a victim node receives a malicious P_DATA_REPLY from its peer or a man-in-the-middle on that link; recv_dless_read() is reached from drbdd() without any local syscall or ioctl on the victim.\nAC:L - The peer fully controls the wire length in the P_DATA_REPLY header, and two independent triggers (unsigned-to-signed overflow or digest subtraction underflow) deterministically force expect negative so drbd_recv_all_warn() receives SIZE_MAX bytes whenever the victim issues a remote read.\nPR:N - No account, capability, or administrative access on the victim host is required; a malicious DRBD peer or network man-in-the-middle on the replication link can send the crafted reply after connection setup, and cram-hmac-alg peer authentication is optional.\nUI:N - No end-user action is needed because diskless-primary and read-balancing configurations automatically send P_DATA_REQUEST packets to the peer, and the malicious P_DATA_REPLY is processed in the kernel receiver thread during normal I/O.\nS:U - The out-of-bounds socket receive corrupts kernel memory on the same host that runs DRBD; successful exploitation yields kernel compromise on that node but does not by itself cross a VM, container, or IOMMU security boundary.\nC:H - Receiving up to SIZE_MAX attacker-controlled bytes past the mapped bio page is an out-of-bounds kernel write that can corrupt adjacent heap or page data and be leveraged for arbitrary kernel memory disclosure, not merely a bounded leak.\nI:H - The bug copies attacker-chosen network data beyond the allocated bio buffer boundary, providing a kernel out-of-bounds write primitive that can corrupt kernel structures and enable arbitrary code execution or privilege escalation.\nA:H - Writing gigabytes past a bio page can immediately corrupt critical kernel memory and cause oops or panic, and repeated malicious replies can keep the node unavailable even before full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:26.031Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bca33f5442c3094511719d9db792ce3165d87e76"
        },
        {
          "url": "https://git.kernel.org/stable/c/741a682535deffe9ab7e5c89caf83571efbc9dd9"
        },
        {
          "url": "https://git.kernel.org/stable/c/f14e87d7b166490bceb9603b39310e51595d05b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/f16866c62656865854106b79bcf6e4ca97a51a92"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f59a8142000f0b8f75c432209ead73c424a745d"
        },
        {
          "url": "https://git.kernel.org/stable/c/38cc4867540ae8beedfe41a1a1a6ed37052c77d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/648d4317326e6aa3f8c05cbf0fd14cc2eba6ca99"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd910a7660d280595ef94cb6d193951d855d330f"
        }
      ],
      "title": "drbd: reject data replies with an out-of-range payload size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72014",
    "datePublished": "2026-08-15T05:51:42.741Z",
    "dateReserved": "2026-08-09T03:40:39.899Z",
    "dateUpdated": "2026-08-17T05:39:26.031Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72014",
      "date": "2026-09-21",
      "epss": "0.00684",
      "percentile": "0.50718"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/block/drbd/drbd_receiver.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "bca33f5442c3094511719d9db792ce3165d87e76",
                    "status": "affected",
                    "version": "b411b3637fa71fce9cf2acf0639009500f5892fe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "741a682535deffe9ab7e5c89caf83571efbc9dd9",
                    "status": "affected",
                    "version": "b411b3637fa71fce9cf2acf0639009500f5892fe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f14e87d7b166490bceb9603b39310e51595d05b9",
                    "status": "affected",
                    "version": "b411b3637fa71fce9cf2acf0639009500f5892fe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f16866c62656865854106b79bcf6e4ca97a51a92",
                    "status": "affected",
                    "version": "b411b3637fa71fce9cf2acf0639009500f5892fe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5f59a8142000f0b8f75c432209ead73c424a745d",
                    "status": "affected",
                    "version": "b411b3637fa71fce9cf2acf0639009500f5892fe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "38cc4867540ae8beedfe41a1a1a6ed37052c77d6",
                    "status": "affected",
                    "version": "b411b3637fa71fce9cf2acf0639009500f5892fe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "648d4317326e6aa3f8c05cbf0fd14cc2eba6ca99",
                    "status": "affected",
                    "version": "b411b3637fa71fce9cf2acf0639009500f5892fe",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bd910a7660d280595ef94cb6d193951d855d330f",
                    "status": "affected",
                    "version": "b411b3637fa71fce9cf2acf0639009500f5892fe",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/block/drbd/drbd_receiver.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.33"
                  },
                  {
                    "lessThan": "2.6.33",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrbd: reject data replies with an out-of-range payload size\n\nrecv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an\noutstanding read request. The peer-supplied payload length reaches it as\nthe signed int data_size, and two peer-controlled inputs can make it\nnegative. With a negotiated data-integrity-alg the digest length is\nsubtracted first, so a reply whose payload is smaller than the digest\nunderflows data_size. With no integrity algorithm (the default) data_size\nis assigned from the unsigned h95/h100 wire length and drbdd() never\nbounds it for a payload-carrying command, so a length above INT_MAX casts\nit negative; this path needs no non-default feature. The bio receive loop\nthen computes expect = min_t(int, data_size, bv_len), which is negative,\nand drbd_recv_all_warn(mapped, expect) receives with a size_t of SIZE_MAX\ninto the first mapped page.\n\nThe sibling receive path read_in_block() is not affected: it uses an\nunsigned size and rejects it against DRBD_MAX_BIO_SIZE before receiving.\nReject a data reply whose size is negative after the optional digest\nsubtraction, covering both triggers.\n\nImpact: a malicious or man-in-the-middle DRBD peer copies attacker-chosen\nbytes past a bio page in the receiver, corrupting kernel memory. A node\nthat reads from its peer (a diskless node, or read-balancing to the peer)\nis exposed in the default configuration; data-integrity-alg is not\nrequired."
          }
        ],
        "id": "CVE-2026-72014",
        "lastModified": "2026-08-17T06:17:58.877",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:00.173",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/38cc4867540ae8beedfe41a1a1a6ed37052c77d6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5f59a8142000f0b8f75c432209ead73c424a745d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/648d4317326e6aa3f8c05cbf0fd14cc2eba6ca99"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/741a682535deffe9ab7e5c89caf83571efbc9dd9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bca33f5442c3094511719d9db792ce3165d87e76"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bd910a7660d280595ef94cb6d193951d855d330f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f14e87d7b166490bceb9603b39310e51595d05b9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f16866c62656865854106b79bcf6e4ca97a51a92"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T16:05:57+00:00",
      "cve": "CVE-2026-72014",
      "id": "CVE-2026-72014",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drbd: reject data replies with an out-of-range payload size",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72014.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:31:46Z",
      "cve": "CVE-2026-72014",
      "id": "CVE-2026-72014",
      "initial_release_date": "2026-08-18T16:55:13Z",
      "product_status:known_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72014",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72014.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.