---
id: CVE-2026-72041
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  espintcp: use sk_msg_free_partial to fix partial send

  sk_msg_free_partial() ensures consistency of the skmsg at every
  iteration, without having to manually handle unch…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  espintcp: use sk_msg_free_partial to fix partial send

  sk_msg_free_partial() ensures consistency of the skmsg at every
  iteration, without having to manually handle unch…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
published: '2026-08-15'
updated: '2026-08-23'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72041'
references:
  - url: 'https://git.kernel.org/stable/c/007800408002d871f5699bdb944f985896730b8f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/14c0b42c8a2cd9b5361bbff45b52f69c62c6a286'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4ea8c051b4bd7feec7749a980f2f70e1782b84d7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/518dcb84b997dff461800b079e5f2596389f766a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/54d73f18f8919735f4d04d6f43374f75756c0180'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a338ce41bc933d8f74c39d9b3b6f1d8ca53d9714'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a66d45e0ce6d73cd79962d422388e61bfaf0cb50'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a977f78adce40b39d90d9567e7987bb110102810'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00714
epssPercentile: 0.53474
ingestedAt: '2026-08-23T13:48:07.598Z'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 <
    518dcb84b997dff461800b079e5f2596389f766a
  - >-
    Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 <
    4ea8c051b4bd7feec7749a980f2f70e1782b84d7
  - >-
    Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 <
    a977f78adce40b39d90d9567e7987bb110102810
  - >-
    Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 <
    54d73f18f8919735f4d04d6f43374f75756c0180
  - >-
    Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 <
    14c0b42c8a2cd9b5361bbff45b52f69c62c6a286
  - >-
    Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 <
    a66d45e0ce6d73cd79962d422388e61bfaf0cb50
  - >-
    Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 <
    a338ce41bc933d8f74c39d9b3b6f1d8ca53d9714
  - >-
    Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 <
    007800408002d871f5699bdb944f985896730b8f
  - Linux 5.6
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:50:34.375706Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

espintcp: use sk_msg_free_partial to fix partial send

sk_msg_free_partial() ensures consistency of the skmsg at every
iteration, without having to manually handle uncharges and offsets.
This simplifies the code, and fixes some bugs in skmsg accounting when
we don't send the full contents.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.