CVE-2026-72401

Received Received - Intake

Memory Leak in Linux Kernel BPF Verifier

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix insn_aux_data leak on verifier err_free_env path When bpf_check() allocates env->insn_aux_data successfully but later fails to allocate env->succ, it jumps directly to err_free_env. The existing vfree(env->insn_aux_data) sits before the err_free_env label, so that direct jump bypasses it and leaks insn_aux_data. Move vfree(env->insn_aux_data) into err_free_env so all early and late exit paths release it consistently.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72401

EUVD

EUVD-2026-59300

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a memory leak vulnerability in the Linux kernel's BPF verifier. When the verifier fails to allocate memory for a specific structure, it bypasses cleanup code that should free previously allocated memory. This causes a resource leak where allocated memory is not released, potentially leading to system resource exhaustion over time.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF verifier and does not have network-based detection methods. Detection requires checking the kernel version and BPF-related components for the affected code path. Use uname -a to check the kernel version and grep for BPF-related logs or errors in system logs.

Impact Analysis

The impact depends on system usage. On systems running BPF programs, this could lead to gradual memory exhaustion, causing performance degradation or system instability. Attackers might exploit this to trigger denial-of-service conditions by repeatedly triggering the vulnerable code path.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a memory leak in the Linux kernel's BPF verifier. Compliance impacts would only occur if the leak led to system instability or unauthorized access, which is not described in the provided context.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this vulnerability. Reboot the system after updating to ensure the patched kernel is active. Monitor system logs for BPF-related errors post-update to confirm the fix is applied.

Hi! I’m here to help you understand CVE-2026-72401. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70