{"resourceId":"netapp-advisory-ntap-20261106-0001-linux-kernel-select-deploy-critical-20261106","versions":[{"version":"external-2f455a92711e83fb131d501297da178f1eabd1e7dc59215e3d0105971fe985c3","resource":{"id":"netapp-advisory-ntap-20261106-0001-linux-kernel-select-deploy-critical-20261106","title":"NetApp advisory NTAP-20261106-0001: critical Linux kernel CVE-2026-72493; ONTAP Select Deploy Affected","organization":"NetApp Product Security","sector":"Storage vendor security advisory","geography":"Global","publishedAt":"Advisory v1.0, last updated 6 November 2026","publicationDate":"2026-11-06","eventDate":null,"sourceName":"NetApp Product Security","sourceLabel":"NetApp, Security Advisory NTAP-20261106-0001, v1.0, 6 November 2026","sourceUrl":"https://security.netapp.com/advisory/ntap-20261106-0001","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","infrastructure"],"finding":"On 6 November 2026 NetApp published interim NTAP-20261106-0001 v1.0 for CVE-2026-72493, a Linux kernel slab use-after-free in older 3.x kernel ranges. CVSS 3.1 scores it CRITICAL 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Affected Products lists ONTAP Select Deploy administration utility. Investigating includes Brocade Fabric Operating System Firmware, NetApp Console Agent OVA, SolidFire & HCI management and storage nodes, and SnapCenter Plug-in for VMware vSphere. ONTAP 9, StorageGRID and SnapCenter (non-plugin) appear Not Affected. Status Interim; exploitation Public; workarounds none; fixes empty.","sledRelevance":"Relevant to SLED virtualization estates that use ONTAP Select Deploy to stand up software-defined ONTAP, and to operators still running Investigating Console Agent OVA, SolidFire/HCI or SnapCenter VMware plugin components. Core ONTAP 9 hardware arrays are listed Not Affected, so risk concentrates on Select Deploy and adjacent management/HCI tooling rather than primary AFF controllers.","evidence":"Opened the rendered advisory page via WebFetch and the official adv_api JSON for NTAP-20261106-0001; read summary, impact, scoring, Affected/Investigating/Not Affected lists and revision history. Vendor self-disclosure; kernel.org stable commits referenced.","architectureImplications":"Isolate ONTAP Select Deploy administration hosts and Investigating Console/HCI/SnapCenter-plugin endpoints from non-admin networks until NetApp publishes fixes or clears Investigating products.","governanceImplications":"Track Interim disposition for Select Deploy and Investigating products; document which virtualization-adjacent NetApp tools are in production.","securityPrivacyImplications":"Successful exploitation could disclose sensitive information, add or modify data, or cause DoS where a vulnerable kernel is reachable with low privileges.","caveats":"Interim; no workaround or fix; Investigating products may still move to Not Affected; ONTAP 9 Not Affected does not clear Select Deploy; product tables from adv_api.","streamIds":["netapp"],"roles":{"sales":"Frame this as risk hygiene for customers using ONTAP Select Deploy or Investigating Console/HCI/SnapCenter-plugin tools—not as an ONTAP 9 hardware scare. The 6 November NTAP-20261106-0001 rates CVE-2026-72493 critical (9.9), lists Select Deploy Affected, keeps Console Agent OVA, SolidFire/HCI and SnapCenter VMware plugin under Investigating, and lists ONTAP 9 Not Affected. Offer a bounded Select Deploy / management-tool inventory. Do not claim ONTAP arrays are Affected or that Investigating products are confirmed exploited in SLED.","engineering":"Locate ONTAP Select Deploy administration utility instances and confirm network exposure. Enumerate Investigating Console Agent OVA, SolidFire/HCI nodes and SnapCenter VMware plugin deployments still listed as open. Prefer isolating those management planes until NetApp publishes fixes or clears them, rather than relying on IP allowlists alone. Rely on ONTAP 9’s Not Affected listing only after verifying Select Deploy is not also in the estate.","delivery":"Open a tracking item owned by security operations with storage and virtualization owners. Close when Select Deploy is patched or cleared and Investigating Console/HCI/plugin products are patched or Not Affected, documenting which tools were in scope for leadership. Acceptance criteria below are proposals, not observed results. Risks include missing Select Deploy VMs and assuming ONTAP 9 Not Affected covers Select Deploy."},"roleDetails":{"sales":{"customerProblem":"SLED teams need clarity on whether ONTAP Select Deploy or adjacent Console/HCI tools sit in this critical advisory’s scope.","stakeholders":["CISO","Storage manager","Virtualization lead"],"discoveryQuestions":["Do you run ONTAP Select Deploy administration utility?","Which Console Agent OVA, SolidFire/HCI or SnapCenter VMware plugin components are in production?"],"valueHypothesis":"Accurate Select Deploy and management-tool inventory prevents false confidence from ONTAP 9’s Not Affected listing.","potentialEngagement":"A bounded Select Deploy / management-plane advisory-mapping workshop.","unsupportedClaims":["ONTAP 9 hardware arrays are Affected","Any Investigating product is confirmed exploited in SLED","Fixes are already published"]},"engineering":{"fit":"Estates with ONTAP Select Deploy or Investigating Console/HCI/SnapCenter-plugin components; low fit for pure ONTAP 9 hardware-only stacks listed Not Affected.","architectureIntegration":"Isolate Select Deploy and Investigating management endpoints from untrusted networks pending fixes.","prerequisites":["Select Deploy inventory","Console/HCI/SnapCenter-plugin deployment map"],"constraints":["Interim advisory","No workaround or fix","Investigating list still open"],"security":"Limit exposure of Affected Select Deploy and Investigating management-plane products; patch when NetApp publishes fixes.","proofOfValue":["Select Deploy instances mapped and network-restricted","Investigating Console/HCI/plugin components inventoried"]},"delivery":{"work":"Inventory Select Deploy and Investigating tools, restrict access, track the advisory, patch when listed.","dependencies":["NetApp product disposition and fixes","Change window for Select Deploy/HCI"],"ownership":"Security operations with storage and virtualization owners.","skillsAdoption":"No new skills; VM and management-tool inventory discipline.","governanceCheckpoints":["Change approval for Select Deploy/HCI updates","Close only when Affected/Investigating items are cleared or patched"],"acceptanceCriteria":["Select Deploy instances inventoried and access-restricted (proposal)","Listed products patched or confirmed Not Affected (proposal)"],"risks":["Assuming ONTAP 9 Not Affected covers Select Deploy","Overlooked SolidFire/HCI or SnapCenter plugin hosts"]}},"retrievedAt":"2026-11-06T22:08:20-06:00","enrichedAt":"2026-11-06T22:12:30-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"SLED teams may need partner help to locate Select Deploy appliances and map Investigating HCI/Console components.","procurementImplications":"No new purchase; prioritize patch readiness under existing support for Select Deploy and Investigating tools.","operatingModelImplications":"Security, storage and virtualization owners should jointly track Select Deploy and Investigating management-plane products.","peerReview":"unknown","sourceVerification":{"openedUrl":"https://security.netapp.com/advisory/ntap-20261106-0001","referenceExcerpt":"Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}