CVE-2026-72297

net: atm: reject out-of-range traffic classes in QoS validation

State: Published
Severity: 7.1 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: atm: reject out-of-range traffic classes in QoS validation

Reject ATM traffic classes above ATM_ANYCLASS in check_tp(). SO_ATMQOS stores the supplied QoS after check_qos() succeeds, so accepting larger values leaves invalid traffic_class values in vcc->qos.

That bad state later reaches pvc_info(), which indexes class_name[] with vcc->qos.{rx,tp}.traffic_class. Values above ATM_ANYCLASS cause an out-of-bounds read when /proc/net/atm/pvc is read.

Tighten the existing QoS validation so invalid traffic_class values are rejected at the point where user supplied QoS is accepted.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1a6dda72455b399ce9c1a12695471dc4d5c61addAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2b3e241729e87afed13ac0f666472d5d6ca42e87Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 367acd288bc6255e247cb1a1efbf5c6567cab423Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 513f820b3f0cf4462e17d84c39ed3948d061a6eaAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 15444b57fdc6fc3f3e22a87f791ae5be81e6ecf5Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e62adb157c2eaad9ad4867ec6cd9af5b9a51b1c7Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 806b7b6edc8446e8b94b706807a7090a14d47b5cAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before cdf19f380e46192e7084be559638aab1f6ed86a2Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1a6dda72455b399ce9c1a12695471dc4d5c61addAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2b3e241729e87afed13ac0f666472d5d6ca42e87Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 367acd288bc6255e247cb1a1efbf5c6567cab423Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 513f820b3f0cf4462e17d84c39ed3948d061a6eaAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 15444b57fdc6fc3f3e22a87f791ae5be81e6ecf5Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e62adb157c2eaad9ad4867ec6cd9af5b9a51b1c7Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 806b7b6edc8446e8b94b706807a7090a14d47b5cAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before cdf19f380e46192e7084be559638aab1f6ed86a2Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.