CVE-2026-72110

Received Received - Intake

BPF Task Storage Use-After-Free in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf,fork: wipe ->bpf_storage before bailouts that access it Currently, copy_process() can bail out to free_task() before p->bpf_storage has been initialized, with this call graph (shown here for the !CONFIG_MEMCG case): copy_process dup_task_struct arch_dup_task_struct [copies the entire task_struct, including ->bpf_storage member] [RLIMIT_NPROC check fails] delayed_free_task free_task bpf_task_storage_free rcu_dereference(task->bpf_storage) bpf_local_storage_destroy In this case, the nascent task's ->bpf_storage member that bpf_local_storage_destroy() operates on is a plain copy of the parent's ->bpf_storage pointer, not a real initialized pointer. This leads to badness (kernel hangs, UAF). This is reachable as long as the process calling fork() has been inserted into a task storage map.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-23

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72110

EUVD

EUVD-2026-59068

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of BPF (Berkeley Packet Filter) storage during process forking. When a process forks, the child process may inherit an uninitialized BPF storage pointer from the parent. If the fork operation fails due to resource limits, the child process is freed improperly, leading to a use-after-free (UAF) condition or kernel hangs. This occurs because the BPF storage pointer is copied but not properly initialized before potential bailouts.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation and requires kernel-level access to detect. It involves a use-after-free condition in the bpf_storage handling during fork operations. Detection would typically involve checking kernel logs for hangs or crashes during process forking, especially when BPF task storage is in use. No direct network detection commands are applicable.

Impact Analysis

This vulnerability can cause system instability, including kernel crashes or hangs, which may lead to denial-of-service conditions. If exploited, it could allow attackers to execute arbitrary code with kernel privileges, compromising the entire system. Users running affected Linux kernel versions with BPF task storage enabled are at risk.

Compliance Impact

The provided CVE data does not describe any direct impact on compliance with GDPR, HIPAA, or similar standards. The vulnerability is kernel-specific and relates to memory management in the Linux kernel during process forking, which could lead to kernel hangs or use-after-free conditions. Compliance implications would depend on system-specific configurations and usage.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If patching is not immediately possible, consider disabling BPF task storage or restricting access to BPF functionality until the kernel is updated. Monitor kernel logs for signs of hangs or crashes during process forking.

Hi! I’m here to help you understand CVE-2026-72110. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70