CVE-2026-72111

Received Received - Intake

BPF Verifier Register Bounds Narrowing Issue in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register bounds before narrowing retval range in check_mem_access() When the BPF verifier processes a context load of an LSM hook return value, it calls __mark_reg_s32_range() to narrow the register to the hook's valid range. However, __mark_reg_s32_range() intersects the new range with the register's existing bounds using max_t()/min_t() rather than replacing them. If the destination register carries stale bounds from a prior instruction (e.g. BPF_MOV64_IMM), the intersection can produce a range narrower than reality. The verifier then believes it knows the register's exact value, while at runtime the actual hook return value is loaded, creating a verifier/runtime mismatch that can be used to bypass BPF memory safety checks. The else branch already calls mark_reg_unknown() to reset register state before any narrowing. Apply the same reset in the is_retval path so stale bounds are cleared before __mark_reg_s32_range() intersects.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72111

EUVD

EUVD-2026-59069

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the BPF verifier. It occurs when processing LSM hook return values. The verifier incorrectly narrows register bounds by intersecting new ranges with stale existing bounds instead of resetting them. This creates a mismatch between verifier assumptions and runtime behavior, potentially allowing bypass of memory safety checks.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF verifier and requires kernel-level inspection. Detection involves checking kernel logs for BPF-related errors or verifying if your kernel version includes the fix. Commands like 'dmesg | grep -i bpf' or 'uname -r' may help identify kernel version and potential issues.

Impact Analysis

An attacker with local access could exploit this to bypass BPF memory safety checks, potentially leading to unauthorized memory access or privilege escalation. This could compromise system integrity or allow execution of malicious code.

Compliance Impact

This vulnerability is specific to the Linux kernel's BPF verifier and does not directly affect compliance with GDPR, HIPAA, or similar standards. It primarily impacts memory safety and verifier/runtime consistency in BPF programs.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-72111. If immediate patching is not possible, restrict BPF usage via kernel parameters or disable untrusted BPF programs until patched.

Hi! I’m here to help you understand CVE-2026-72111. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70