CVE-2026-72112

Received Received - Intake

Use-After-Free in Linux Kernel io_uring BPF Operations

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring/bpf-ops: reject re-registration of an already-bound ops io_install_bpf() only rejects a second registration on the ctx side (ctx->bpf_ops) and sets the per-map back-pointer ops->priv unconditionally. The struct_ops link path never advances a map past BPF_STRUCT_OPS_STATE_READY, so the same io_uring_bpf_ops map can be registered more than once, and bpf_io_reg() re-resolves the target ring via fget(ops->ring_fd) on every call. A caller can therefore point the same ring_fd at a different io_ring_ctx between two BPF_LINK_CREATE calls. The second registration passes the ctx->bpf_ops check (the new ctx has none) and overwrites ops->priv, orphaning the first ctx. Teardown (io_eject_bpf()/bpf_io_unreg()) only reaches a ctx through ops->priv, so the orphaned ctx is never torn down: its ctx->loop_step keeps pointing into the struct_ops trampoline, which is freed once the map is gone. A later io_uring_enter() on the orphaned ring then calls the dangling ctx->loop_step from io_run_loop() -- a use-after-free of freed executable memory, reachable by a task with CAP_BPF + CAP_PERFMON. Reject registration when ops->priv is already set, as hid_bpf_reg() does for its struct_ops.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-05

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-04

NVD

CVE-2026-72112

EUVD

EUVD-2026-59070

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in io_uring operations. It occurs when a BPF operation map is re-registered without proper cleanup of the previous registration. This leads to an orphaned io_ring_ctx whose memory is freed but still accessed, causing a use-after-free of executable memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's io_uring and BPF operations. Detection requires checking kernel logs for io_uring-related errors or use-after-free events. Monitor for crashes or unusual behavior in processes using io_uring with BPF. No direct commands are provided in the context.

Impact Analysis

An attacker with CAP_BPF and CAP_PERFMON privileges could exploit this to execute arbitrary code or cause a system crash. This could lead to privilege escalation, data corruption, or denial of service on affected systems.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a technical flaw in the Linux kernel's io_uring and BPF operations. Compliance impacts would depend on how the vulnerability is exploited in a specific system or environment.

Mitigation Strategies

Update the Linux kernel to the latest patched version that resolves this issue. Avoid using io_uring with BPF operations until the patch is applied. Restrict CAP_BPF and CAP_PERFMON capabilities to reduce attack surface.

Hi! I’m here to help you understand CVE-2026-72112. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70