---
id: CVE-2026-72298
title: 'net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()'
summary: "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()\n\nqrtr_endpoint_post() validates an incoming packet with\n\n\tif (!size || len != ALIGN(size, 4) + hdrlen)\n\t\t…"
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 960b08dd36de1e341e3eb43d1c547513e338f4f8 <
    3665e644ea081c4624a1637023b0de3b29f4ae04
  - >-
    Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d <
    b609f7f46916c6b05585ca82455077198a23770f
  - >-
    Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d <
    242408b5b763c01288adf3113cbce84378a76e1a
  - >-
    Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d <
    d0597074e99731fdad5593e4f6d056a3866f2cab
  - >-
    Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d <
    689b7267f8632b4661879dc323e26ebb60978afb
  - >-
    Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d <
    22100a8f73d4ae4f17697dae93d4e2e1d283a6ec
  - >-
    Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d <
    7f72c285f6d3bf63968a0344beee8ab1b370198b
  - >-
    Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d <
    20054869770c7df060c5ecee3e8bbf9029c47191
  - Linux f8111c0d7ed42ede41a3d0d393b104de0730a8a6
  - Linux 26b8d10703a9be45d6097946b2b4011f7dd2c56f
  - Linux 19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe
  - Linux >= 5.10.46 < 5.10.261
  - Linux >= 4.19.196 < 4.20
  - Linux >= 5.4.128 < 5.5
  - Linux >= 5.12.13 < 5.13
  - Linux 5.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:46:01.998827Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:15.699Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72298'
references:
  - url: 'https://git.kernel.org/stable/c/3665e644ea081c4624a1637023b0de3b29f4ae04'
  - url: 'https://git.kernel.org/stable/c/b609f7f46916c6b05585ca82455077198a23770f'
  - url: 'https://git.kernel.org/stable/c/242408b5b763c01288adf3113cbce84378a76e1a'
  - url: 'https://git.kernel.org/stable/c/d0597074e99731fdad5593e4f6d056a3866f2cab'
  - url: 'https://git.kernel.org/stable/c/689b7267f8632b4661879dc323e26ebb60978afb'
  - url: 'https://git.kernel.org/stable/c/22100a8f73d4ae4f17697dae93d4e2e1d283a6ec'
  - url: 'https://git.kernel.org/stable/c/7f72c285f6d3bf63968a0344beee8ab1b370198b'
  - url: 'https://git.kernel.org/stable/c/20054869770c7df060c5ecee3e8bbf9029c47191'
tags:
  - cve.org
epss: 0.00185
epssPercentile: 0.07563
ingestedAt: '2026-10-16T19:46:24.411Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()

qrtr_endpoint_post() validates an incoming packet with

	if (!size || len != ALIGN(size, 4) + hdrlen)
		goto err;

where size comes from the wire. On 32-bit, size_t is 32 bits and
ALIGN(size, 4) wraps to 0 for size >= 0xfffffffd, so the check
passes and skb_put_data(skb, data + hdrlen, size) writes past the
hdrlen-sized skb and oopses the kernel. 64-bit is unaffected.

This is the 32-bit residual of ad9d24c9429e2 ("net: qrtr: fix OOB
Read in qrtr_endpoint_post"), which fixed only the 64-bit case.

Reject any size that cannot fit the buffer before the ALIGN.

## Affected

- `Linux >= 960b08dd36de1e341e3eb43d1c547513e338f4f8 < 3665e644ea081c4624a1637023b0de3b29f4ae04`
- `Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d < b609f7f46916c6b05585ca82455077198a23770f`
- `Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d < 242408b5b763c01288adf3113cbce84378a76e1a`
- `Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d < d0597074e99731fdad5593e4f6d056a3866f2cab`
- `Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d < 689b7267f8632b4661879dc323e26ebb60978afb`
- `Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d < 22100a8f73d4ae4f17697dae93d4e2e1d283a6ec`
- `Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d < 7f72c285f6d3bf63968a0344beee8ab1b370198b`
- `Linux >= ad9d24c9429e2159d1e279dc3a83191ccb4daf1d < 20054869770c7df060c5ecee3e8bbf9029c47191`
- `Linux f8111c0d7ed42ede41a3d0d393b104de0730a8a6`
- `Linux 26b8d10703a9be45d6097946b2b4011f7dd2c56f`
- `Linux 19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe`
- `Linux >= 5.10.46 < 5.10.261`
- `Linux >= 4.19.196 < 4.20`
- `Linux >= 5.4.128 < 5.5`
- `Linux >= 5.12.13 < 5.13`
- `Linux 5.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.