CVE-2026-72041 espintcp: use sk_msg_free_partial to fix partial send
A bug in Linux kernel ESP-in-TCP handling caused incorrect memory accounting during partial sends, potentially leading to resource inconsistencies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72041?
CVE-2026-72041 is a critical vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
espintcp: use sk_msg_free_partial to fix partial send
sk_msg_free_partial() ensures consistency of the skmsg at every iteration, without having to manually handle uncharges and offsets. This simplifies the code, and fixes some bugs in skmsg accounting when we don't send the full contents.
Weakness: CWE-664
Which versions are affected by CVE-2026-72041?
How do I fix CVE-2026-72041?
Apply the vendor's patch.
Is CVE-2026-72041 being exploited?
There is no known exploitation of CVE-2026-72041 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72041, DEBIAN-CVE-2026-72041, GHSA-55rh-f38r-fhcc, UBUNTU-CVE-2026-72041.