---
id: CVE-2026-72041
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  espintcp: use sk_msg_free_partial to fix partial send

  sk_msg_free_partial() ensures consistency of the skmsg at every
  iteration, without having to manually handle unch…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  espintcp: use sk_msg_free_partial to fix partial send

  sk_msg_free_partial() ensures consistency of the skmsg at every
  iteration, without having to manually handle unch…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
published: '2026-08-15'
updated: '2026-08-23'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72041'
references:
  - url: 'https://git.kernel.org/stable/c/007800408002d871f5699bdb944f985896730b8f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/14c0b42c8a2cd9b5361bbff45b52f69c62c6a286'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4ea8c051b4bd7feec7749a980f2f70e1782b84d7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/518dcb84b997dff461800b079e5f2596389f766a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/54d73f18f8919735f4d04d6f43374f75756c0180'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a338ce41bc933d8f74c39d9b3b6f1d8ca53d9714'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a66d45e0ce6d73cd79962d422388e61bfaf0cb50'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a977f78adce40b39d90d9567e7987bb110102810'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00695
epssPercentile: 0.51572
ingestedAt: '2026-08-23T13:48:07.598Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

espintcp: use sk_msg_free_partial to fix partial send

sk_msg_free_partial() ensures consistency of the skmsg at every
iteration, without having to manually handle uncharges and offsets.
This simplifies the code, and fixes some bugs in skmsg accounting when
we don't send the full contents.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.