CVE-2026-72297

A flaw was found in the Linux kernel's Asynchronous Transfer Mode (ATM) networking module. This vulnerability occurs due to insufficient validation of traffic classes during Quality of Service (QoS) setup. A local user can exploit this by providing out-of-range traffic class values, which are then stored as invalid data. When the /proc/net/atm/pvc file is subsequently read, it leads to an out-of-bounds read, potentially resulting in information disclosure.

An out-of-bounds read in the ATM procfs reporting path can occur because SO_ATMQOS accepts traffic_class values above ATM_ANYCLASS and stores them in vcc qos. The invalid value later reaches pvc_info(), where it is used as an index into class_name when /proc/net/atm/pvc is read. For the CVSS the PR:L is used because a local user or local process must supply the QoS value and trigger the procfs read, but full administrative privileges are not clearly required by the patch context. The issue is not directly network reachable because remote ATM traffic does not set the local SO_ATMQOS state. Impact is at least local information disclosure or denial of service. In the paranoid score, controlled out-of-bounds kernel reads may expose more sensitive memory or cause a kernel crash, so this should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.