CVE-2026-72298

CVE-2026-72298 reveals a dangerous pattern: a kernel vulnerability marked as fixed that was actually only partially mitigated on 32-bit systems. The flaw lives in qrtr_endpoint_post(), part of Qualcomm's QRTR IPC subsystem used for inter-processor communication in mobile, IoT, and automotive silicon. An earlier patch addressed an out-of-bounds read vulnerability on 64-bit systems but left a residual on 32-bit deployments—an incomplete fix that created a false security baseline. The root cause is the ALIGN macro's behavior when handling size values near the 32-bit limit. When size >= 0xfffffffd, ALIGN(size, 4) wraps to zero due to integer overflow, bypassing the intended bounds check. A developer working on a 64-bit machine reproduced the original vulnerability, shipped a 64-bit fix, and the commit message claimed completeness without architectural qualification. No one asked whether the integer arithmetic held across all supported architectures. The practical risk is asymmetric. The CVSS 8.4 reflects a kernel panic from malformed network input—a denial of service, but in QRTR's context, this isn't a desktop server concern. The affected 32-bit systems are embedded deployments where kernel oopses can cascade into device brickings or safety system faults. The low EPSS score (0.00182) confirms automated scanners never caught this: security tooling treats patched CVEs as closed cases and stops looking. If you're defending 32-bit embedded deployments using Qualcomm silicon, treat the QRTR subsystem as unpatched until you confirm the CVE-2026-72298 fix is applied. Audit your kernel version and verify the qrtr code path. Beyond this specific case, assume other network subsystem vulnerabilities patched in recent kernels may have architecture-incomplete residuals—the commit history of the original fix shows the pattern clearly. Demand explicit architecture coverage documentation in future kernel security patches, not implicit assumptions about universal integer behavior.

Reviewed through automated stages and approved by a human before publication.