---
id: CVE-2026-72298
title: "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()\n\nqrtr_endpoint_post() validates an incoming packet with\n\n\tif (!size || len != ALIGN(size, 4) + hdrlen)\n\t\t…"
summary: "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()\n\nqrtr_endpoint_post() validates an incoming packet with\n\n\tif (!size || len != ALIGN(size, 4) + hdrlen)\n\t\t…"
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 960b08dd36de1e341e3eb43d1c547513e338f4f8 <
    3665e644ea081c4624a1637023b0de3b29f4ae04
  - >-
    Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d <
    b609f7f46916c6b05585ca82455077198a23770f
  - >-
    Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d <
    242408b5b763c01288adf3113cbce84378a76e1a
  - >-
    Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d <
    d0597074e99731fdad5593e4f6d056a3866f2cab
  - >-
    Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d <
    689b7267f8632b4661879dc323e26ebb60978afb
  - >-
    Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d <
    22100a8f73d4ae4f17697dae93d4e2e1d283a6ec
  - >-
    Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d <
    7f72c285f6d3bf63968a0344beee8ab1b370198b
  - >-
    Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d <
    20054869770c7df060c5ecee3e8bbf9029c47191
  - Linux f8111c0d7ed42ede41a3d0d393b104de0730a8a6
  - Linux 26b8d10703a9be45d6097946b2b4011f7dd2c56f
  - Linux 19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe
  - Linux >= 5.10.46 < 5.10.261
  - Linux >= 4.19.196 < 4.20
  - Linux >= 5.4.128 < 5.5
  - Linux >= 5.12.13 < 5.13
  - Linux 5.13
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:17:19.843'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72298'
references:
  - url: 'https://git.kernel.org/stable/c/20054869770c7df060c5ecee3e8bbf9029c47191'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/22100a8f73d4ae4f17697dae93d4e2e1d283a6ec'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/242408b5b763c01288adf3113cbce84378a76e1a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3665e644ea081c4624a1637023b0de3b29f4ae04'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/689b7267f8632b4661879dc323e26ebb60978afb'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7f72c285f6d3bf63968a0344beee8ab1b370198b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b609f7f46916c6b05585ca82455077198a23770f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d0597074e99731fdad5593e4f6d056a3866f2cab'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00185
epssPercentile: 0.08015
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:46:01.998827Z'
ingestedAt: '2026-10-16T19:46:24.411Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()

qrtr_endpoint_post() validates an incoming packet with

	if (!size || len != ALIGN(size, 4) + hdrlen)
		goto err;

where size comes from the wire. On 32-bit, size_t is 32 bits and
ALIGN(size, 4) wraps to 0 for size >= 0xfffffffd, so the check
passes and skb_put_data(skb, data + hdrlen, size) writes past the
hdrlen-sized skb and oopses the kernel. 64-bit is unaffected.

This is the 32-bit residual of ad9d24c9429e2 ("net: qrtr: fix OOB
Read in qrtr_endpoint_post"), which fixed only the 64-bit case.

Reject any size that cannot fit the buffer before the ALIGN.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.