CVE-2026-72043: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-f7xg-fgxp-p6w3
Share
CVSS 7.1
Published
Advisory Summary

CVE-2026-72043 is a HIGH (CVSS 7.1) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-72043 at a Glance

CVE Identifier CVE-2026-72043
GHSA Identifier GHSA-f7xg-fgxp-p6w3
Severity HIGH
CVSS v3.1 Base Score 7.1
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.1

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability None (A:N)

How to Fix CVE-2026-72043

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-72043, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() When hardware page table walker (PTW) is enabled on LoongArch, the CPU may set _PAGE_DIRTY directly in the page table entry during a write TLB miss, without going through the software TLB store handler. The software TLB store handler (tlbex.S:254) sets both _PAGE_DIRTY and_PAGE_MODIFIED together: ori t0, t0, (_PAGE_VALID | _PAGE_DIRTY | _PAGE_MODIFIED) Since hardware PTW only sets _PAGE_DIRTY, the software-only bit, i.e. _PAGE_MODIFIED is left unchanged. This creates a window where a PTE has _PAGE_DIRTY set (hardware knows the page is dirty) but _PAGE_MODIFIED clear (software is unaware). When fork()/clone() triggers copy-on-write, __copy_present_ptes() calls pte_wrprotect(), which unconditionally clears both the _PAGE_WRITE and _PAGE_DIRTY bits: pte_val(pte) &= ~(_PAGE_WRITE | _PAGE_DIRTY); Since _PAGE_MODIFIED was never set, the dirtiness information is lost completely. Subsequently, when memory pressure triggers page reclaim, page_mkclean() / try_to_unmap() sees the page as clean (i.e. pte_dirty() returns false) and the page may be freed without writeback, causing data corruption. Fix this by propagating the _PAGE_DIRTY bit to the _PAGE_MODIFIED bit in both pte_wrprotect() and pmd_wrprotect() before clearing writeable bits: if (pte_val(pte) & _PAGE_DIRTY) pte_val(pte) |= _PAGE_MODIFIED; The pmd_wrprotect() fix handles the CONFIG_TRANSPARENT_HUGEPAGE case, where pmd entries need the same treatment. This ensures the software dirty tracking bit (checked by pte_dirty() and pmd_dirty(), which read both the _PAGE_DIRTY and _PAGE_MODIFIED bits) is preserved across fork COW write-protection. The issue was found by the LTP madvise09 test case, which exercises page reclaim after "madvise(MADV_FREE), write and fork" operation sequence on private anonymous mappings.

References

NVD — CVE-2026-72043 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-72043
git.kernel.org/stable/c/018e9828eb... WEB
https://git.kernel.org/stable/c/018e9828eb523c638fa3d9bdf0fd4956b74555b2
git.kernel.org/stable/c/39bb21a4bf... WEB
https://git.kernel.org/stable/c/39bb21a4bff0d70058bf752d7b5aa2e2ccc864a9
git.kernel.org/stable/c/76f8865076... WEB
https://git.kernel.org/stable/c/76f88650763a35cbf1384c65d66d096fa31cc58d
git.kernel.org/stable/c/a65f49b6f7... WEB
https://git.kernel.org/stable/c/a65f49b6f7ece756394f8f0e85570020e7fd0e35
git.kernel.org/stable/c/e483da9608... WEB
https://git.kernel.org/stable/c/e483da960892c41fa7f0cf0d2fc2410d65a483d6
git.kernel.org/stable/c/e8a916579e... WEB
https://git.kernel.org/stable/c/e8a916579e427af32f2de8213dfa23c5df6e6664

Frequently Asked Questions

What is CVE-2026-72043?
CVE-2026-72043 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-72043?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-72043?
CVE-2026-72043 has a CVSS v3.1 base score of 7.1 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
What CWE is associated with CVE-2026-72043?
CVE-2026-72043 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-72043?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-f7xg-fgxp-p6w3",
  "modified" : "2026-08-17T06:33:06Z",
  "published" : "2026-08-15T06:32:10Z",
  "aliases" : [ "CVE-2026-72043" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()\n\nWhen hardware page table walker (PTW) is enabled on LoongArch, the CPU\nmay set _PAGE_DIRTY directly in the page table entry during a write TLB\nmiss, without going through the software TLB store handler. The software\nTLB store handler (tlbex.S:254) sets both _PAGE_DIRTY and_PAGE_MODIFIED\ntogether:\n\n    ori t0, t0, (_PAGE_VALID | _PAGE_DIRTY | _PAGE_MODIFIED)\n\nSince hardware PTW only sets _PAGE_DIRTY, the software-only bit, i.e.\n_PAGE_MODIFIED is left unchanged. This creates a window where a PTE has\n_PAGE_DIRTY set (hardware knows the page is dirty) but _PAGE_MODIFIED\nclear (software is unaware).\n\nWhen fork()/clone() triggers copy-on-write, __copy_present_ptes() calls\npte_wrprotect(), which unconditionally clears both the _PAGE_WRITE and\n_PAGE_DIRTY bits:\n\n    pte_val(pte) &= ~(_PAGE_WRITE | _PAGE_DIRTY);\n\nSince _PAGE_MODIFIED was never set, the dirtiness information is lost\ncompletely. Subsequently, when memory pressure triggers page reclaim,\npage_mkclean() / try_to_unmap() sees the page as clean (i.e. pte_dirty()\nreturns false) and the page may be freed without writeback, causing data\ncorruption.\n\nFix this by propagating the _PAGE_DIRTY bit to the _PAGE_MODIFIED bit in\nboth pte_wrprotect() and pmd_wrprotect() before clearing writeable bits:\n\n    if (pte_val(pte) & _PAGE_DIRTY)\n        pte_val(pte) |= _PAGE_MODIFIED;\n\nThe pmd_wrprotect() fix handles the CONFIG_TRANSPARENT_HUGEPAGE case,\nwhere pmd entries need the same treatment.\n\nThis ensures the software dirty tracking bit (checked by pte_dirty() and\npmd_dirty(), which read both the _PAGE_DIRTY and _PAGE_MODIFIED bits) is\npreserved across fork COW write-protection.\n\nThe issue was found by the LTP madvise09 test case, which exercises page\nreclaim after \"madvise(MADV_FREE), write and fork\" operation sequence on\nprivate anonymous mappings.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-72043"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/018e9828eb523c638fa3d9bdf0fd4956b74555b2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/39bb21a4bff0d70058bf752d7b5aa2e2ccc864a9"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/76f88650763a35cbf1384c65d66d096fa31cc58d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a65f49b6f7ece756394f8f0e85570020e7fd0e35"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/e483da960892c41fa7f0cf0d2fc2410d65a483d6"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/e8a916579e427af32f2de8213dfa23c5df6e6664"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T06:21:13Z"
  }
}