CVE-2026-72392: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-gqrm-563w-26qf
Share
Published
Advisory Summary

CVE-2026-72392 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-72392 at a Glance

CVE Identifier CVE-2026-72392
GHSA Identifier GHSA-gqrm-563w-26qf
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-72392

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-72392, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump inet6_dump_fib() saves its progress in cb->args[1] as a positional index within the current hash chain. Between batches, a concurrent fib6_new_table() can insert a new table at the chain head, shifting all existing entries. The saved index then lands on a different table, causing fib6_dump_table() to set w->root to the wrong table while w->node still points into the previous one. fib6_walk_continue() dereferences w->node->parent (NULL) and panics: BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:fib6_walk_continue+0x6e/0x170 Call Trace: <TASK> fib6_dump_table.isra.0+0xc5/0x240 inet6_dump_fib+0xf6/0x420 rtnl_dumpit+0x30/0xa0 netlink_dump+0x15b/0x460 netlink_recvmsg+0x1d6/0x2a0 ____sys_recvmsg+0x17a/0x190 Fix by storing tb->tb6_id in cb->args[1] instead of a positional index. On resume, skip entries until the id matches; a concurrent head-insert can never match the saved id, so the walker always resumes on the correct table.

References

NVD — CVE-2026-72392 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-72392
git.kernel.org/stable/c/059efb48dd... WEB
https://git.kernel.org/stable/c/059efb48dd746518898faaa9b965511009b59639
git.kernel.org/stable/c/110ccbd28c... WEB
https://git.kernel.org/stable/c/110ccbd28c9444866fcc84ba96a2ad64fa6e95ae
git.kernel.org/stable/c/27210d433a... WEB
https://git.kernel.org/stable/c/27210d433a8c5fe6bf7278a04bbaeb49a81d0290
git.kernel.org/stable/c/89f9c5fee3... WEB
https://git.kernel.org/stable/c/89f9c5fee3c64c5cabc34e65599308fd3c879cf9
git.kernel.org/stable/c/9facb861dc... WEB
https://git.kernel.org/stable/c/9facb861dc6b9b9ea9793ef5032a9a826f7a4229
git.kernel.org/stable/c/cb90a774a9... WEB
https://git.kernel.org/stable/c/cb90a774a9c6c46961a44949a246fbb61f5f934c
git.kernel.org/stable/c/d8a01d2787... WEB
https://git.kernel.org/stable/c/d8a01d27873e04bebd357dc87859aa756e0b28b2
git.kernel.org/stable/c/ee73a32dd2... WEB
https://git.kernel.org/stable/c/ee73a32dd258d4af66831ff006b771e19812b322

Frequently Asked Questions

What is CVE-2026-72392?
CVE-2026-72392 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-72392?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-72392?
CVE-2026-72392 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-72392?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-gqrm-563w-26qf",
  "modified" : "2026-08-19T18:32:27Z",
  "published" : "2026-08-15T06:32:22Z",
  "aliases" : [ "CVE-2026-72392" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump\n\ninet6_dump_fib() saves its progress in cb->args[1] as a positional\nindex within the current hash chain.  Between batches, a concurrent\nfib6_new_table() can insert a new table at the chain head, shifting\nall existing entries.  The saved index then lands on a different\ntable, causing fib6_dump_table() to set w->root to the wrong table\nwhile w->node still points into the previous one.\nfib6_walk_continue() dereferences w->node->parent (NULL) and panics:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000008\n  RIP: 0010:fib6_walk_continue+0x6e/0x170\n  Call Trace:\n   <TASK>\n   fib6_dump_table.isra.0+0xc5/0x240\n   inet6_dump_fib+0xf6/0x420\n   rtnl_dumpit+0x30/0xa0\n   netlink_dump+0x15b/0x460\n   netlink_recvmsg+0x1d6/0x2a0\n   ____sys_recvmsg+0x17a/0x190\n\nFix by storing tb->tb6_id in cb->args[1] instead of a positional\nindex.  On resume, skip entries until the id matches; a concurrent\nhead-insert can never match the saved id, so the walker always\nresumes on the correct table.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-72392"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/059efb48dd746518898faaa9b965511009b59639"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/110ccbd28c9444866fcc84ba96a2ad64fa6e95ae"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/27210d433a8c5fe6bf7278a04bbaeb49a81d0290"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/89f9c5fee3c64c5cabc34e65599308fd3c879cf9"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9facb861dc6b9b9ea9793ef5032a9a826f7a4229"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/cb90a774a9c6c46961a44949a246fbb61f5f934c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d8a01d27873e04bebd357dc87859aa756e0b28b2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ee73a32dd258d4af66831ff006b771e19812b322"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T06:22:12Z"
  }
}