CVE-2026-72297

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ATM network subsystem where the check tp() function fails to reject traffic classes exceeding ATM ANYCLASS. When SO ATMQOS stores the supplied Quality of Service (QoS) after check qos() succeeds, invalid traffic class values can remain in vcc->qos. This state is subsequently processed by the pvc info() function, which uses vcc->qos.{rx,tp}.traffic class to index the class name[] array. If the values exceed ATM ANYCLASS, it results in an out-of-bounds read when the /proc/net/atm/pvc endpoint is accessed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.