In the Linux kernel, the following vulnerability has been resolved: net: atm: reject out-of-range traffic classes in QoS validation Reject ATM traffic classes above ATM_ANYCLASS in check_tp(). SO_ATMQOS stores the supplied QoS after check_qos() succeeds, so accepting larger values leaves invalid traffic_class values in vcc->qos. That bad state later reaches pvc_info(), which indexes class_name[] with vcc->qos.{rx,tp}.traffic_class. Values above ATM_ANYCLASS cause an out-of-bounds read when /proc/net/atm/pvc is read. Tighten the existing QoS validation so invalid traffic_class values are rejected at the point where user supplied QoS is accepted.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/15444b57fdc6fc3f3e22a87f791ae5be81e6ecf5 cve-icon cve-icon
https://git.kernel.org/stable/c/1a6dda72455b399ce9c1a12695471dc4d5c61add cve-icon cve-icon
https://git.kernel.org/stable/c/2b3e241729e87afed13ac0f666472d5d6ca42e87 cve-icon cve-icon
https://git.kernel.org/stable/c/367acd288bc6255e247cb1a1efbf5c6567cab423 cve-icon cve-icon
https://git.kernel.org/stable/c/513f820b3f0cf4462e17d84c39ed3948d061a6ea cve-icon cve-icon
https://git.kernel.org/stable/c/806b7b6edc8446e8b94b706807a7090a14d47b5c cve-icon cve-icon
https://git.kernel.org/stable/c/cdf19f380e46192e7084be559638aab1f6ed86a2 cve-icon cve-icon
https://git.kernel.org/stable/c/e62adb157c2eaad9ad4867ec6cd9af5b9a51b1c7 cve-icon cve-icon
History

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: atm: reject out-of-range traffic classes in QoS validation Reject ATM traffic classes above ATM_ANYCLASS in check_tp(). SO_ATMQOS stores the supplied QoS after check_qos() succeeds, so accepting larger values leaves invalid traffic_class values in vcc->qos. That bad state later reaches pvc_info(), which indexes class_name[] with vcc->qos.{rx,tp}.traffic_class. Values above ATM_ANYCLASS cause an out-of-bounds read when /proc/net/atm/pvc is read. Tighten the existing QoS validation so invalid traffic_class values are rejected at the point where user supplied QoS is accepted.
Title net: atm: reject out-of-range traffic classes in QoS validation
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:55:17.877Z

Reserved: 2026-08-09T03:40:39.917Z

Link: CVE-2026-72297

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:22:02.293

Modified: 2026-08-15T06:22:02.293

Link: CVE-2026-72297

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.