0.0
NA
CVE-2026-72025
s390/monwriter: Reject buffer reuse with different data length
Description

In the Linux kernel, the following vulnerability has been resolved: s390/monwriter: Reject buffer reuse with different data length When data buffers are reused, e.g. for interval sample records, the first record determines the data length, and the size of the buffer for user copy. Current monwriter code does not check if the data length was changed for subsequent records, which also would never happen for valid user programs. However, a malicious user could change the data length, resulting in out of bounds user copy to the kernel buffer, and memory corruption. By default, the monwriter misc device is created with root-only permissions, so practical impact is typically low. Fix this by checking for changed data length and rejecting such records.

INFO

Published Date :

Aug. 15, 2026, 6:21 a.m.

Last Modified :

Aug. 18, 2026, 7:16 a.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-72025 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
Solution
Prevent memory corruption by checking buffer data length consistency.
  • Apply kernel patches that check data length before buffer reuse.
  • Ensure interval sample records have consistent data lengths.
  • Restrict access to the monwriter misc device.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-72025 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-72025 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-72025 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-72025 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 18, 2026

    Action Type Old Value New Value
    Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '096dff1247037d329c04b3a5be0ecdfb1c5c7ac6', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': 'd39cf4a6d721b1ae21eb53bbf3e8cd984253d7ab', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '759d91378203ea35fa9bca6726dcf0010de081fb', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '036bc5661060702e798d215e81bb46da530965b3', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '01f3ce411711c2c919598ea25320a5a48f71edbc', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': 'f0745496f7c171271cafd9457df3b914a483ddeb', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': 'ae5347f3db1782c6118f6cc0d9fd8b1d43397db3', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '2995ccec260caa9e85b3301a4aba1e66ed80ad74', 'versionType': 'git'}, {'status': 'affected', 'version': '0', 'lessThan': '5.10.261', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '5.15.212', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '6.1.178', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '6.6.145', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '6.12.97', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '6.18.40', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '7.1.5', 'versionType': 'semver'}], 'programFiles': ['drivers/s390/char/monwriter.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/s390/char/monwriter.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '31b58088292c7f00f0b81088bfb557285b0b6247', 'lessThan': '096dff1247037d329c04b3a5be0ecdfb1c5c7ac6', 'versionType': 'git'}, {'status': 'affected', 'version': '31b58088292c7f00f0b81088bfb557285b0b6247', 'lessThan': 'd39cf4a6d721b1ae21eb53bbf3e8cd984253d7ab', 'versionType': 'git'}, {'status': 'affected', 'version': '31b58088292c7f00f0b81088bfb557285b0b6247', 'lessThan': '759d91378203ea35fa9bca6726dcf0010de081fb', 'versionType': 'git'}, {'status': 'affected', 'version': '31b58088292c7f00f0b81088bfb557285b0b6247', 'lessThan': '036bc5661060702e798d215e81bb46da530965b3', 'versionType': 'git'}, {'status': 'affected', 'version': '31b58088292c7f00f0b81088bfb557285b0b6247', 'lessThan': '01f3ce411711c2c919598ea25320a5a48f71edbc', 'versionType': 'git'}, {'status': 'affected', 'version': '31b58088292c7f00f0b81088bfb557285b0b6247', 'lessThan': 'f0745496f7c171271cafd9457df3b914a483ddeb', 'versionType': 'git'}, {'status': 'affected', 'version': '31b58088292c7f00f0b81088bfb557285b0b6247', 'lessThan': 'ae5347f3db1782c6118f6cc0d9fd8b1d43397db3', 'versionType': 'git'}, {'status': 'affected', 'version': '31b58088292c7f00f0b81088bfb557285b0b6247', 'lessThan': '2995ccec260caa9e85b3301a4aba1e66ed80ad74', 'versionType': 'git'}], 'programFiles': ['drivers/s390/char/monwriter.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.19'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.19', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/s390/char/monwriter.c'], 'defaultStatus': 'affected'}]
  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 17, 2026

    Action Type Old Value New Value
    Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '096dff1247037d329c04b3a5be0ecdfb1c5c7ac6', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': 'd39cf4a6d721b1ae21eb53bbf3e8cd984253d7ab', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '759d91378203ea35fa9bca6726dcf0010de081fb', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '036bc5661060702e798d215e81bb46da530965b3', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '01f3ce411711c2c919598ea25320a5a48f71edbc', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': 'f0745496f7c171271cafd9457df3b914a483ddeb', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': 'ae5347f3db1782c6118f6cc0d9fd8b1d43397db3', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '2995ccec260caa9e85b3301a4aba1e66ed80ad74', 'versionType': 'git'}, {'status': 'affected', 'version': '0', 'lessThan': '5.10.261', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '5.15.212', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '6.1.178', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '6.6.145', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '6.12.97', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '6.18.40', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '7.1.5', 'versionType': 'semver'}], 'programFiles': ['drivers/s390/char/monwriter.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/s390/char/monwriter.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '096dff1247037d329c04b3a5be0ecdfb1c5c7ac6', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': 'd39cf4a6d721b1ae21eb53bbf3e8cd984253d7ab', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '759d91378203ea35fa9bca6726dcf0010de081fb', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '036bc5661060702e798d215e81bb46da530965b3', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '01f3ce411711c2c919598ea25320a5a48f71edbc', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': 'f0745496f7c171271cafd9457df3b914a483ddeb', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': 'ae5347f3db1782c6118f6cc0d9fd8b1d43397db3', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '2995ccec260caa9e85b3301a4aba1e66ed80ad74', 'versionType': 'git'}, {'status': 'affected', 'version': '0', 'lessThan': '5.10.261', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '5.15.212', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '6.1.178', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '6.6.145', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '6.12.97', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '6.18.40', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '7.1.5', 'versionType': 'semver'}], 'programFiles': ['drivers/s390/char/monwriter.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/s390/char/monwriter.c'], 'defaultStatus': 'affected'}]
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 15, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '096dff1247037d329c04b3a5be0ecdfb1c5c7ac6', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': 'd39cf4a6d721b1ae21eb53bbf3e8cd984253d7ab', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '759d91378203ea35fa9bca6726dcf0010de081fb', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '036bc5661060702e798d215e81bb46da530965b3', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '01f3ce411711c2c919598ea25320a5a48f71edbc', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': 'f0745496f7c171271cafd9457df3b914a483ddeb', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': 'ae5347f3db1782c6118f6cc0d9fd8b1d43397db3', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '2995ccec260caa9e85b3301a4aba1e66ed80ad74', 'versionType': 'git'}, {'status': 'affected', 'version': '0', 'lessThan': '5.10.261', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '5.15.212', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '6.1.178', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '6.6.145', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '6.12.97', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '6.18.40', 'versionType': 'semver'}, {'status': 'affected', 'version': '0', 'lessThan': '7.1.5', 'versionType': 'semver'}], 'programFiles': ['drivers/s390/char/monwriter.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/s390/char/monwriter.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: s390/monwriter: Reject buffer reuse with different data length When data buffers are reused, e.g. for interval sample records, the first record determines the data length, and the size of the buffer for user copy. Current monwriter code does not check if the data length was changed for subsequent records, which also would never happen for valid user programs. However, a malicious user could change the data length, resulting in out of bounds user copy to the kernel buffer, and memory corruption. By default, the monwriter misc device is created with root-only permissions, so practical impact is typically low. Fix this by checking for changed data length and rejecting such records.
    Added Reference https://git.kernel.org/stable/c/01f3ce411711c2c919598ea25320a5a48f71edbc
    Added Reference https://git.kernel.org/stable/c/036bc5661060702e798d215e81bb46da530965b3
    Added Reference https://git.kernel.org/stable/c/096dff1247037d329c04b3a5be0ecdfb1c5c7ac6
    Added Reference https://git.kernel.org/stable/c/2995ccec260caa9e85b3301a4aba1e66ed80ad74
    Added Reference https://git.kernel.org/stable/c/759d91378203ea35fa9bca6726dcf0010de081fb
    Added Reference https://git.kernel.org/stable/c/ae5347f3db1782c6118f6cc0d9fd8b1d43397db3
    Added Reference https://git.kernel.org/stable/c/d39cf4a6d721b1ae21eb53bbf3e8cd984253d7ab
    Added Reference https://git.kernel.org/stable/c/f0745496f7c171271cafd9457df3b914a483ddeb
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.