CVE-2026-72018

Think of the Linux kernel as the building's foundation, and this loopback feature as an internal pipe used to move data between parts of that foundation. This bug means the pipe doesn't check that data fits where it's supposed to go, so someone already inside the building with basic access could overflow it and damage load-bearing parts of the foundation, potentially taking over the whole structure.

This matters to you if you run servers or systems using the Linux kernel, particularly where multiple users or services share a machine with standard local accounts. The issue only matters if an attacker can already log in or run code locally with some level of access — it is not exploitable remotely by itself.

This is a high-severity kernel flaw that is reachable by default wherever the loopback feature is active, and a successful attack can corrupt kernel memory badly enough to escalate privileges or crash the system — that combination of easy access and severe outcome is why this needs prompt attention. There is no confirmed active exploitation or public exploit code yet, but the low bar for triggering it (any local low-privilege account) means it should not be left unpatched.

Confirm exposure by checking your running kernel version and whether the DIBS loopback driver module is loaded/in use on multi-user or multi-tenant systems. The fix is included in kernel commits ee188a6b264b71315a67f1b9470faad308b730d2, b2f426a9a22886071966432ede8fceafffe12b8c, 94fe0ab01b480b52bd8f977edbd845ef375d69fd, and 78237e3c0720fcc6eb9b87e90fd70f63eeca886f — apply the kernel update for your distribution branch that incorporates one of these. There is no documented workaround other than restricting local account access or disabling the loopback driver if it is not needed, pending the update. Not in CISA KEV and no public exploit or active-exploitation reports exist as of now, so there is no mandated remediation deadline, but given CVSS 7.8 and default reachability, treat this as a routine-but-prompt kernel patch cycle item. Monitor vendor kernel advisories and your distro's security feed for the backported fix.

CVSS 3.1 score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) — local attack vector, low complexity, low privileges required, no user interaction, high impact on confidentiality, integrity and availability. Weakness class: missing bounds check leading to out-of-bounds write (CWE-787-type) in the DIBS loopback move_data() function, where offset+size is not validated against the registered DMB length before a memcpy. Not in CISA KEV; no public PoC or exploit code identified; EPSS places predicted near-term exploitation likelihood very low with a flat trend, consistent with no observed in-the-wild activity. Press attention is rising only as part of a general vulnerability roundup, not tied to any exploitation claim.