CVE-2026-72380

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds write exists in the pvcalls front event handler() function. The function uses the req id variable, obtained from a backend-supplied ring response, to index the fixed-size bedata->rsp[] array without performing a range check. Because req id was declared as an int while the wire field rsp->req id is a u32, a signed value check is insufficient; for example, a value of 0xffffffff is interpreted as -1, allowing access to bedata->rsp[-1]. A malicious or buggy backend can provide a req id exceeding PVCALLS NR RSP PER RING to trigger an out-of-bounds write beyond the bedata allocation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.