CVE-2026-72341: Software Security Vulnerability Vulnerability

UNKNOWN

Advisory Identifier: GHSA-rffj-59x2-vrx3

Published 2026-08-15

Advisory Summary

CVE-2026-72341 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-72341 at a Glance

CVE Identifier CVE-2026-72341

GHSA Identifier GHSA-rffj-59x2-vrx3

Severity N/A

CVSS v3.1 Base Score N/A

CWE Classification General Security Weakness

Affected Product Software

Package Ecosystem Maven

Published Date 2026-08-15

Last Updated 2026-08-15

How to Fix CVE-2026-72341

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-72341, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix publication race for priv->channel_stats[] mlx5e_channel_stats_alloc() publishes a new entry to priv->channel_stats[] and then increments priv->stats_nch as a publication token, but neither store carries any memory barrier: priv->channel_stats[ix] = kvzalloc_node(...); if (!priv->channel_stats[ix]) return -ENOMEM; priv->stats_nch++; Concurrent readers compute the loop bound from priv->stats_nch and then dereference priv->channel_stats[i] using plain accesses, e.g. for (i = 0; i < priv->stats_nch; i++) { struct mlx5e_channel_stats *cs = priv->channel_stats[i]; ... cs->rq.packets ... } On weakly-ordered architectures (ARM, PowerPC, RISC-V) the writes to channel_stats[ix] and stats_nch may become visible to other CPUs out of program order. A reader can observe stats_nch == N while still seeing channel_stats[N-1] == NULL, leading to a NULL pointer dereference in the channel_stats loop. This has been observed in production on BlueField-3 DPUs (arm64), where ovs-vswitchd queries netdev statistics over netlink during NIC bringup, racing mlx5e_open_channel() -> mlx5e_channel_stats_alloc() on another CPU: Unable to handle kernel NULL pointer dereference at virtual address 0x840 Hardware name: BlueField-3 DPU pc : mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core] Call trace: mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core] dev_get_stats+0x50/0xc0 ovs_vport_get_stats+0x38/0xac [openvswitch] ovs_vport_cmd_fill_info+0x194/0x290 [openvswitch] ovs_vport_cmd_get+0xbc/0x10c [openvswitch] genl_family_rcv_msg_doit+0xd0/0x160 genl_rcv_msg+0xec/0x1f0 netlink_rcv_skb+0x64/0x130 genl_rcv+0x40/0x60 netlink_unicast+0x2fc/0x370 netlink_sendmsg+0x1dc/0x454 ... __arm64_sys_sendmsg+0x2c/0x40 Add mlx5e_stats_nch_write() and mlx5e_stats_nch_read() helpers in en.h that wrap the smp_store_release()/smp_load_acquire() pair on stats_nch. The release/acquire pair establishes the contract: stats_nch == N => channel_stats[0..N-1] are visible and non-NULL. Publish the stats_nch increment via mlx5e_stats_nch_write() in the writer (mlx5e_channel_stats_alloc()), and read stats_nch via mlx5e_stats_nch_read() in all readers: mlx5e RX/TX queue stats, mlx5e_get_base_stats(), ethtool channels stats, IPoIB stats, the sw_stats fold and the HV VHCA stats agent.

References

NVD — CVE-2026-72341 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-72341

git.kernel.org/stable/c/5a799714e8... WEB

https://git.kernel.org/stable/c/5a799714e8ca0bce9ea40694f49914cf1adbbaa9

git.kernel.org/stable/c/5c7e3755ab... WEB

https://git.kernel.org/stable/c/5c7e3755abf663f033de24f917b77685e9543045

git.kernel.org/stable/c/815515ec68... WEB

https://git.kernel.org/stable/c/815515ec68f527ca755cb1e2c1ff9148f6b3ea56

Frequently Asked Questions

What is CVE-2026-72341?

CVE-2026-72341 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.

Which Software versions are affected?

Affected versions include releases prior to current release patches.

What version fixes CVE-2026-72341?

Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.

What CWE is associated with CVE-2026-72341?

CVE-2026-72341 is classified under General Security Weakness.

How can I check Maven dependencies for CVE-2026-72341?

Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rffj-59x2-vrx3",
  "modified" : "2026-08-15T06:32:21Z",
  "published" : "2026-08-15T06:32:20Z",
  "aliases" : [ "CVE-2026-72341" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix publication race for priv->channel_stats[]\n\nmlx5e_channel_stats_alloc() publishes a new entry to\npriv->channel_stats[] and then increments priv->stats_nch as a\npublication token, but neither store carries any memory barrier:\n\n\tpriv->channel_stats[ix] = kvzalloc_node(...);\n\tif (!priv->channel_stats[ix])\n\t\treturn -ENOMEM;\n\tpriv->stats_nch++;\n\nConcurrent readers compute the loop bound from priv->stats_nch and\nthen dereference priv->channel_stats[i] using plain accesses, e.g.\n\n\tfor (i = 0; i < priv->stats_nch; i++) {\n\t\tstruct mlx5e_channel_stats *cs = priv->channel_stats[i];\n\t\t... cs->rq.packets ...\n\t}\n\nOn weakly-ordered architectures (ARM, PowerPC, RISC-V) the writes to\nchannel_stats[ix] and stats_nch may become visible to other CPUs out\nof program order. A reader can observe stats_nch == N while still\nseeing channel_stats[N-1] == NULL, leading to a NULL pointer\ndereference in the channel_stats loop.\n\nThis has been observed in production on BlueField-3 DPUs (arm64),\nwhere ovs-vswitchd queries netdev statistics over netlink during NIC\nbringup, racing mlx5e_open_channel() -> mlx5e_channel_stats_alloc()\non another CPU:\n\n  Unable to handle kernel NULL pointer dereference at virtual address 0x840\n  Hardware name: BlueField-3 DPU\n  pc : mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core]\n  Call trace:\n   mlx5e_fold_sw_stats64+0x30/0x180 [mlx5_core]\n   dev_get_stats+0x50/0xc0\n   ovs_vport_get_stats+0x38/0xac [openvswitch]\n   ovs_vport_cmd_fill_info+0x194/0x290 [openvswitch]\n   ovs_vport_cmd_get+0xbc/0x10c [openvswitch]\n   genl_family_rcv_msg_doit+0xd0/0x160\n   genl_rcv_msg+0xec/0x1f0\n   netlink_rcv_skb+0x64/0x130\n   genl_rcv+0x40/0x60\n   netlink_unicast+0x2fc/0x370\n   netlink_sendmsg+0x1dc/0x454\n   ...\n   __arm64_sys_sendmsg+0x2c/0x40\n\nAdd mlx5e_stats_nch_write() and mlx5e_stats_nch_read() helpers in en.h\nthat wrap the smp_store_release()/smp_load_acquire() pair on stats_nch.\nThe release/acquire pair establishes the contract:\n\n  stats_nch == N  =>  channel_stats[0..N-1] are visible and non-NULL.\n\nPublish the stats_nch increment via mlx5e_stats_nch_write() in the\nwriter (mlx5e_channel_stats_alloc()), and read stats_nch via\nmlx5e_stats_nch_read() in all readers: mlx5e RX/TX queue stats,\nmlx5e_get_base_stats(), ethtool channels stats, IPoIB stats, the\nsw_stats fold and the HV VHCA stats agent.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-72341"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5a799714e8ca0bce9ea40694f49914cf1adbbaa9"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5c7e3755abf663f033de24f917b77685e9543045"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/815515ec68f527ca755cb1e2c1ff9148f6b3ea56"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T06:22:07Z"
  }
}

Advisory Metadata

Source ID: GHSA-rffj-59x2-vrx3
Schema Version: 1.4.0
Published: 2026-08-15 06:32
Last Modified: 2026-08-15 06:32
Database Record File: advisories/unreviewed/2026/08/GHSA-rffj-59x2-vrx3/GHSA-rffj-59x2-vrx3.json