A fix is available — apply it.
In the Linux kernel, the following vulnerability has been resolved:
mtd: rawnand: pl353: fix probe resource allocation
During probe(), the devm_ioremap() is called with the parent device instead of the current one. So when the module is unloaded, the register area isn't released.
Target the pl35x device in the devm_ioremap() instead of its parent.
What the EG score is made of (scorer v4.0: the three questions the 0–10 score mixes, published apart · methodology)
BOD 26-04 (CISA's remediation timeline, Table 1)14 days if the affected system is publicly exposed; Fix on system upgrade if it is not.
In CISA KEV no (CISA's KEV catalog) · Automatable no (CISA's BOD 26-04 default) · Technical impact total (CISA's BOD 26-04 default). Where an input reads “CISA's BOD 26-04 default”, no one has published it for this CVE, and CISA's implementation guidance says: “If “Automatable” and “Technical Impact” information items about a CVE ID are not available and the CVE ID is not in the KEV Catalog, CISA will treat its values as “no” and “total,” respectively, until CISA or a third party provides metadata about the CVE ID. CISA will always provide the Vulnrichment data for a CVE ID listed in the KEV Catalog.” Whether your system is publicly exposed is yours to answer. BOD 26-04 binds US Federal Civilian Executive Branch agencies; for anyone else it is CISA's published timeline, a reference rather than an obligation. The directive · how EchelonGraph applies it
August 15, 2026
August 17, 2026
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
| Vendor / Ecosystem | Fix (by version range) / Patch | Released | Source |
|---|---|---|---|
| ubuntu | linux-tools-azure-fde-lts-22.04 (5.15.0.1122.131) @ jammy | 2026-10-06 | ubuntu |
| ubuntu | linux-tools-gcp-edge (5.15.0.1118.128~20.04.1) @ focal | 2026-10-06 | ubuntu |
| ubuntu | linux-tools-oracle-edge (5.15.0.1114.120~20.04.1) @ focal | 2026-10-06 | ubuntu |
| ubuntu | linux-tools-gcp-lts-22.04 (5.15.0.1118.115) @ jammy | 2026-10-06 | ubuntu |
| ubuntu | linux-xilinx-zynqmp-tools-5.15.0-1080 (5.15.0-1080.84) @ jammy | 2026-10-06 | ubuntu |
Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| linux | 6.1.106-1 ... 6.1.99-1 (55 versions) |
| — |
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| linux | 6.12.38-1 ... 6.12.96-1 (31 versions) |
| — |
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| linux | 6.12.100-1 ... 7.1~rc7-1~exp1 (160 versions) |
| — |
Every vendor that published an advisory referencing this CVE — pulled from our cve_vendor_advisories aggregation. Click any row for the vendor's original advisory page.
Each row is a time one of our pipelines fetched, updated or re-scored this CVE. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. An arrow marks a change the record states ("CVSS v3 → 9.1"); EPSS and GHSA rows show the values recorded at that time, not what changed (EPSS values are rounded; hover one for the exact figures). Most recent first.
A repeat, a row identical to one the same pipeline wrote less than 10 seconds earlier, is not a separate refresh and is not counted. 2 repeat rows among the latest 84 are merged into the row they repeat.
ubuntu:USN-8875-1
See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-72167
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.