CVE-2026-72065

net: mana: Validate the packet length reported by the NIC

State: Published
Severity: 9.8 Critical
Published: Aug 15, 2026
Updated: Oct 19, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: mana: Validate the packet length reported by the NIC

Validate the packet length reported in the RX CQE before passing it to skb processing. The CQE is supplied by the NIC device and should not be blindly trusted.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
LinuxLinux	ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before a631f82f89c76084ad5b2b9c043d3b391ffa56d8Affected ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before d2568e64d01f480200063fadd67d6938f676c66fAffected ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 2e276b14b6d378372bf0152df89286cbe7632fb0Affected ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 6080189291d958604dcefe513a13900835ac982fAffected ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 6d13eaa13341a8f80aaf86f78591e1b1d393711dAffected ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 282c5214ca4eb3799158c76782646e86d2945d1bAffected ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 2e2a83b4998af4384e677d3b2ac08565274279bfAffected
LinuxLinux	5.13Affected before 5.13Not affected 5.15.217 through 5.15.Not affected 6.1.184 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.5 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before a631f82f89c76084ad5b2b9c043d3b391ffa56d8Affected
ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before d2568e64d01f480200063fadd67d6938f676c66fAffected
ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 2e276b14b6d378372bf0152df89286cbe7632fb0Affected
ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 6080189291d958604dcefe513a13900835ac982fAffected
ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 6d13eaa13341a8f80aaf86f78591e1b1d393711dAffected
ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 282c5214ca4eb3799158c76782646e86d2945d1bAffected
ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f to before 2e2a83b4998af4384e677d3b2ac08565274279bfAffected

LinuxLinux

5.13Affected
before 5.13Not affected
5.15.217 through 5.15.*Not affected
6.1.184 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.